How DKIM selectors work: finding, rotating and troubleshooting your DKIM key

Every DKIM signature is tied to a selector. The selector is the name the receiving server uses to look up your public key in DNS. If the selector is missing, wrong, or pointing at the wrong key, your DKIM check fails and your email loses a major trust signal. This guide explains how selectors work, how to find yours, and how to rotate one without breaking delivery.

What a DKIM selector is

A DKIM selector is a short label that appears in two places:

• In the email header: the d= and s= tags in the DKIM-Signature header. The s= tag is the selector.
• In your DNS: as a TXT record at <selector>._domainkey.yourdomain.com.

When a receiving server gets your email, it reads the selector from the DKIM-Signature header, then queries DNS for <selector>._domainkey.yourdomain.com. If that TXT record exists and contains the matching public key, the DKIM check can pass. If the record is missing or the key does not match, the check fails.

The selector is what lets you have multiple DKIM keys at the same time. You can run s1 and s2 in parallel during a key rotation, or use different selectors for different sending services.

Common selector names

Providers pick their own selector names. The most common patterns:

• s1, s2: the most common. Many providers start with s1 and add s2 when they rotate.
• google, k1, k2: Google Workspace and Gmail use selectors like google or k1.
• selector1, selector2: Microsoft 365 and some ESPs use longer, more explicit names.
• Custom names: some providers use branded selectors like mail, dkim, or the service name.

The exact name does not matter as long as it matches between the header and the DNS record. What matters is that the selector you are signing with is the same one the receiving server can find in DNS.

How to find your DKIM selector

There are three reliable ways to find the selector your mail is actually using:

• Check your sending provider's dashboard: most ESPs (SendGrid, Postmark, Mailgun, Amazon SES, Google Workspace, Microsoft 365) show your DKIM selector and the exact DNS record to add.
• Inspect a real email: send a test email, open the raw headers, and find the DKIM-Signature line. The s= tag is your selector.
• Query your DNS: run dig TXT s1._domainkey.yourdomain.com (or s2, google, etc.) and see which selectors have records. The one that matches the header is the one in use.

If you cannot find a matching selector, your DKIM is not set up correctly and your email is failing the DKIM check.

How to rotate a DKIM key without breaking delivery

Rotating a DKIM key is the most common reason a domain suddenly loses DKIM. The safe process:

1. Create the new key with a new selector (for example, move from s1 to s2).
2. Add the new DNS record for s2._domainkey.yourdomain.com while s1 is still live.
3. Wait for DNS propagation (usually a few minutes to a few hours, depending on TTL).
4. Switch your sender to sign with the new selector.
5. Verify the new selector passes by sending a test email and checking the DKIM result.
6. Remove the old selector only after you have confirmed the new one is working and you no longer need to sign with the old key.

The key rule: never delete the old selector before the new one is confirmed working. If you delete s1 before your sender is signing with s2, every email in flight will fail DKIM.

Selector mistakes that break DKIM

• Selector mismatch: the header says s=google but you only have s1._domainkey in DNS. The receiving server cannot find the key.
• Truncated TXT record: DKIM public keys are long. If your DNS provider splits the record incorrectly or the key is cut off, the check fails.
• Wrong key type: signing with a 1024-bit key when the provider expects 2048, or using an RSA key where an Ed25519 key is expected.
• Multiple conflicting keys: two TXT records at the same selector with different keys. The receiving server picks one at random, so the check fails half the time.
• Selector not propagated: you added the DNS record but it has not propagated yet. The check fails until the record is visible worldwide.

How to verify your DKIM is passing

After you set up or rotate a selector, verify the full chain:

• Send a test email to a Gmail or Microsoft address.
• Open the raw headers and confirm the DKIM-Signature header is present.
• Check the s= tag and confirm that selector has a TXT record in DNS.
• Use a deliverability tool to confirm the DKIM check reports "pass" for that selector.

If the DKIM check passes but your email still lands in spam, the problem is likely SPF or DMARC, not DKIM. See the SPF vs DKIM vs DMARC guide.

Want this checked automatically every day? Inboxproof Pro monitors your domain around the clock and alerts you the moment a record breaks or an IP gets listed. See pricing →

Related: SPF vs DKIM vs DMARC · Cold email deliverability · Why email lands in spam · SMTP error codes