How do I find my DKIM selector?

Enter your domain in a DKIM selector finder like this one, which tries about 80 common selectors. If none is found, read the s= tag in the DKIM-Signature header of a message you sent.

What is the DKIM selector for Google Workspace?

google, unless an admin chose another prefix when generating the key. The record is at google._domainkey.yourdomain.

What is the DKIM selector for Microsoft 365?

selector1 and selector2, published as CNAMEs to your onmicrosoft.com tenant so Microsoft can rotate the keys.

Does no selector found mean DKIM isn't set up?

No. Platforms such as Amazon SES, Postmark and HubSpot use a selector unique to your account, which can't be guessed. Check a message's headers to be sure.

Is the DKIM selector finder free?

Yes. It's a free tool, 10 domains a minute, with no account needed.

Does it send email to the domain?

No. Every lookup is a DNS query for a selector name. Nothing connects to the domain's mail servers.

DKIM selector finder: find the DKIM selectors a domain uses

A DKIM selector finder discovers which DKIM selectors a domain publishes when you don't know them. Enter a domain and it tries about 80 selectors that mailbox providers and sending platforms use, such as google, selector1 and s1, and shows each key it finds with its length, whether it's healthy, and the platform it points to.

Tries about 80 selectors in public DNS, two lookups each. Nothing is sent to the domain. 10 domains a minute.

SimpleAPI

Sample result

acme.example signs with 2 DKIM selectors: google (2048-bit) and s1, a CNAME to SendGrid.

Domain: acme.example
google: RSA 2048-bit, Google Workspace
s1: RSA 1024-bit, SendGrid (CNAME)

What this means for you

Now you know your selectors, so you can check, rotate or remove each key without digging through headers.

Next step:Check a selector in depth

No need to know the selector first
Key type, length and health for each
Platform named from the CNAME target
Stale CNAMEs and wildcards flagged

DKIM
Selector
DNS

By SimpleVerifier Team · Last updated October 20, 2026

How do I find which DKIM selectors a domain uses?

Enter a domain, or an email address at it. A pasted selector._domainkey.domain host works too.
Press Find selectors. About 80 selectors are looked up in DNS, a TXT and a CNAME query each, plus one random selector to rule out a wildcard.
Read each selector found: its key type and length, OK or weak, and the platform, named for certain when the selector is a CNAME to the platform's domain.
Download the CSV, or open a selector in the DKIM checker for the full record.

Example

You enter: The domain acme.example.
You get: 2 of 80 selectors have a key: google (RSA 2048-bit, OK, usually Google Workspace) and s1 (RSA 1024-bit, Weak key), a CNAME to s1.domainkey.u1234.wl.sendgrid.net, so SendGrid is named for certain. Download the selectors as CSV.
Limits: One domain per lookup and 10 lookups a minute per connection. Account-specific selectors can't be found.

What is my DKIM selector?

The selector is the name in front of ._domainkey. where a DKIM public key is published: google._domainkey.yourdomain.com for Google Workspace, selector1 and selector2 for Microsoft 365, s1 and s2 for SendGrid, k1 for Mailchimp. Each message names its selector in the s= tag of its DKIM-Signature header (RFC 6376).

DNS can't list a domain's selectors, which is why every DKIM checker asks for one. This finder tries the ones platforms publish under fixed names, so you can find yours without opening a message's headers.

How does it name the platform?

Two ways, and each row says which. When the selector is a CNAME to a domain the platform owns, such as s1.domainkey.u123.wl.sendgrid.net or selector1-yourdomain-com._domainkey.yourtenant.onmicrosoft.com, the platform is certain. When the key is published directly, the row says which platform usually uses that selector name; another service could have chosen the same name.

Why is no selector found?

Some platforms give every account its own selector, such as Amazon SES's random tokens, Postmark's dated selectors and HubSpot's hs1- plus an account number. Those can't be guessed, so a domain can sign every message and still show nothing here.

To find it for certain, send yourself a message and read the s= value in its DKIM-Signature header with the email header analyzer, then check that selector in the DKIM checker.

What key length should a DKIM key have?

At least 1024 bits, and 2048 is recommended: RFC 8301 requires verifiers to reject RSA keys under 1024 bits, and says signers should use 2048. Keys under 2048 bits are marked weak here. See rotating to a 2048-bit DKIM key for how to change one without breaking mail.

How is this different from a DKIM checker?

	This selector finder	A DKIM checker
Needs the selector	No	Usually yes
Selectors tried	About 80	The one you enter, or a short list
Shows	Every key found, its length and platform	One record parsed in depth
Best for	Discovering what signs for a domain	Fixing one record

Who uses this tool, and for what?

IT admins: Find which services still sign as your domain before you rotate keys or move to DMARC p=reject.
Deliverability consultants: See a client's signing platforms and weak keys without asking for message headers first.
Cold emailers: Confirm that each sending domain has a DKIM key from the platform you send through.
Security teams: Spot stale CNAMEs to services the company no longer uses.

What can’t this tool tell you?

Only known selector names are tried; an account-specific selector can't be found from DNS.
A platform named from a selector's name alone is a likely match, not proof.
It shows that a key is published, not that messages pass DKIM; a delivered message's headers show that.
One domain per lookup and 10 lookups a minute.

Common questions

How do I find my DKIM selector?: Enter your domain in a DKIM selector finder like this one, which tries about 80 common selectors. If none is found, read the s= tag in the DKIM-Signature header of a message you sent.
What is the DKIM selector for Google Workspace?: google, unless an admin chose another prefix when generating the key. The record is at google._domainkey.yourdomain.
What is the DKIM selector for Microsoft 365?: selector1 and selector2, published as CNAMEs to your onmicrosoft.com tenant so Microsoft can rotate the keys.
Does no selector found mean DKIM isn't set up?: No. Platforms such as Amazon SES, Postmark and HubSpot use a selector unique to your account, which can't be guessed. Check a message's headers to be sure.
Is the DKIM selector finder free?: Yes. It's a free tool, 10 domains a minute, with no account needed.
Does it send email to the domain?: No. Every lookup is a DNS query for a selector name. Nothing connects to the domain's mail servers.

Sources

Authentication and capacity are half of deliverability.

The other half is who you send to. Every hard bounce counts against the domain and inboxes you are sending from, and nothing in DNS can tell you which addresses on your list are dead.

Bulk verification with real SMTP mailbox checks
Hard bounces removed before a send, not discovered after
Catch-all, disposable and role detection on every row

Get started — $29.99/mo See the published limits first

One plan, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.