DKIM Selector Checker
Look up a DKIM key by selector — and see why a selector cannot be guessed.
How this lookup works
A DKIM key lives in a TXT record at selector._domainkey.domain, and the difficulty is entirely in the selector: DNS has no operation for listing what exists under a name, so nothing can enumerate them. Supply one and it is looked up directly. Leave it blank and the selectors used by Google Workspace, Microsoft 365, Mailchimp, SendGrid and the common self-hosted defaults are tried in turn — which finds most domains and misses every one using a custom selector, and that limitation is stated rather than allowed to read as an absence of DKIM. The real selector is in the DKIM-Signature header of any message the domain has sent, as the s= value.
What the results mean
- Selector
- The label a key is published under. Not discoverable — it comes from a message header.
- Key size
- Derived from the published key. 1024 still verifies everywhere; 2048 is the current expectation.
- Revoked
- An empty p= tag. Valid DNS and the correct way to retire a key, not a broken record.
- Nothing found
- Weak evidence. A custom selector looks exactly like no DKIM at all.
Common problems and fixes
- Nothing found for a domain I know signs mail
- It is using a selector not in the common list. Open any message it sent, find the DKIM-Signature header, and read the s= value.
- Which selector should I use?
- The one in the message header. Providers rotate them, so a selector that worked last year may have been retired — a revoked record with an empty p= is what that looks like.
- The record shows as revoked
- That is deliberate on the domain's part. An empty p= retires a key while leaving the record in place, so signatures made with it stop verifying.
Frequently asked questions
Why can I not list all DKIM selectors for a domain?
Because DNS has no way to enumerate names under a label. You can ask whether a specific name exists; you cannot ask what exists. Every DKIM checker either asks you for the selector or guesses from a list.
Where do I find the selector?
In the DKIM-Signature header of a message the domain has sent, as s=. Most mail clients will show original headers, and that is the only reliable source.
Is a 1024-bit DKIM key a problem?
It still verifies everywhere and is below current practice. 2048 is the expectation for new keys, and several large receivers now reject anything under 1024 outright.
Put this on your own site
Free to embed, no attribution required beyond the source link the frame carries itself. It runs entirely in your visitor's browser, sets no cookies and loads no third-party script.
<iframe src="https://runthetests.com/embed/dkim-checker/" width="100%" height="560" style="border:1px solid #e5e5e5;border-radius:8px" title="DKIM Selector Checker" loading="lazy"></iframe>
Preview it at https://runthetests.com/embed/dkim-checker/. Embedded pages are marked noindex, so yours stays the canonical copy — not this one.