DKIM selector
The subdomain prefix used to publish a DKIM public key, as in google._domainkey.example.com. You cannot look up DKIM without knowing or guessing the selector.
The subdomain prefix used to publish a DKIM public key, as in google._domainkey.example.com. You cannot look up DKIM without knowing or guessing the selector.
What a selector is for
A DKIM selector is a label that tells the receiver which public key to fetch. The key lives at selector._domainkey.yourdomain.com, and the selector is named in the s= tag of each signature.
A domain can have many selectors at once. That is the point: one for Google Workspace, one for your sequencer, one for a newsletter tool, each with its own key and each published and revoked independently.
Why rotating them works
To replace a key you do not edit the live one. You publish a new selector (2025b, say), switch the sender to sign with it, and remove the old record once mail signed with it has stopped arriving. No message is ever verified against a key that has been swapped under it.
Common names
The selector is chosen by whoever generates the key, so it varies. Google Workspace defaults to google. Microsoft 365 uses two, selector1 and selector2, so it can rotate between them. Many sequencers use their own names. Always copy the exact host the provider shows you.
If DKIM fails, check the selector first
The most frequent mistake is a mismatch: the record is published under one selector and the sender is signing with another. Compare the s= value in a received message's headers with the record you published, and look up that exact name:
dig +short TXT google._domainkey.yourdomain.com
See DKIM and the per-provider setup pages.
Ready to try it on a real list?
The subdomain prefix used to publish a DKIM public key, as in google._domainkey.example.com. You cannot look up DKIM without knowing or guessing the selector.
Get startedRelated
- Cold email & deliverability glossary
Plain-language definitions for the terms that come up in cold outreach and email deliverability: bounce rate, catch-all, SPF/DKIM/DMARC, sender reputation, and more.
- Bounce rate — cold email glossary
The share of sent emails a mail server refuses to deliver. A hard bounce means the mailbox does not exist; a soft bounce means it is temporarily unreachable.
- Hard bounce — cold email glossary
A permanent delivery failure: the mailbox does not exist, the domain does not accept mail, or the server has rejected the recipient for good. Hard bounces are the ones that wreck sender reputation.
- Soft bounce — cold email glossary
A temporary delivery failure: a full mailbox, a greylisting delay, or a receiving server that is down. Retrying can succeed; treating every soft bounce as a dead address thins a list for no reason.