If you've ever looked closely at an email's technical headers, you may have spotted a strange snippet like s= followed by a short string of letters and numbers. That's a DKIM selector, and it plays a small but essential role in proving that your emails are genuinely coming from your domain and haven't been tampered with in transit.
What is a DKIM selector?
DKIM (DomainKeys Identified Mail) works by attaching a digital signature to every outgoing email. The receiving mail server needs a way to look up the correct public key to check that signature against, and that's exactly what a DKIM selector does. It's essentially a label, published in your domain's DNS as a TXT record, that points to one specific DKIM key.
Think of it like a filing label on a folder: your domain can hold several DKIM keys at once, each with its own selector, and the selector tells a receiving server which "folder" to open when verifying a particular message.
Why selectors matter
- Key rotation. You can safely retire an old DKIM key and switch to a new one by publishing a new selector, without breaking authentication for mail already in transit.
- Multiple sending sources. If you send email through more than one platform or service, each can use its own selector and key, keeping them independent of one another.
- Easier troubleshooting. When authentication fails, knowing which selector was used helps you pinpoint exactly which key or sending source is misconfigured.
A missing or incorrectly published DKIM selector means the receiving server can't validate your signature at all, which can hurt inbox placement and make your mail look less trustworthy to spam filters.
How to find your DKIM selector
1. Check the email header
Open an email you sent from your domain and view its full source or original headers (most webmail clients have a "View Source" or "Show Original" option). Look for the line starting with DKIM-Signature. Within that line, the s= parameter is your selector — for example, a signature might read s=mail1; d=yourdomain.com;, meaning the selector is mail1.
2. Query DNS directly
If you already know (or suspect) a selector name, you can confirm it with a command-line DNS query. On macOS, Linux, or Windows with the right tools installed, run something like:
dig TXT mail1._domainkey.yourdomain.com
A valid response will return a TXT record containing the public key and related DKIM parameters. No response usually means that selector isn't in use.
3. Use an online DNS lookup tool
Free DNS lookup tools let you enter [selector]._domainkey.[yourdomain.com] and instantly see the resulting TXT record, which is handy if you'd rather not use a terminal.
4. Check your email platform's settings
If you send email through a marketing platform, CRM, or hosted mailbox service, its admin dashboard will usually display the exact selector and DKIM record it expects you to publish — this is often the fastest and most reliable source.
Typical selector patterns by provider
Selector names aren't standardized, but a few patterns show up often:
- Google Workspace selectors often look like a short alphanumeric string paired with the word "google".
- Microsoft 365 commonly uses selectors named along the lines of "selector1" and "selector2".
- Other providers frequently default to something simple like "default" or a short code.
These patterns vary by account and configuration, so always confirm the exact selector in your provider's DKIM setup instructions rather than assuming.
Common issues
- DKIM fails even though a selector exists. Double-check for typos in the selector name or an incomplete TXT record (some DNS panels truncate long keys unless split into quoted segments).
- Multiple sending platforms conflict. Make sure each platform is assigned its own unique selector rather than overwriting one shared record.
- Changes aren't taking effect. DNS updates can take time to propagate; give it a few hours before assuming a record is broken.
FAQ
Do I need to create my own selector? Usually not — most email platforms generate the selector and DKIM key for you and simply ask you to publish the resulting DNS record.
Can I have more than one DKIM selector at a time? Yes, and it's common when you send from multiple platforms or are in the middle of rotating keys.
Where do I add the DNS record for my selector? In your domain's DNS zone, wherever it's hosted — for domains managed through your Avalon hosting account, this is in your DNS zone editor.
