What Is DKIM, and Where Is Your Selector?

DKIM is the signature on your email. Every message you send carries one, and receivers check it against a public key you publish in DNS. If the signature checks out, they know the message really came from your domain and wasn’t changed on the way.

Gmail and Yahoo have expected DKIM from bulk senders since February 2024, alongside SPF and DMARC. Outlook.com has rejected bulk mail that fails them since May 2025.

How DKIM works

Your email platform holds a private key and uses it to sign each message as it goes out. The signature travels in a header called DKIM-Signature. When Gmail receives the message, it looks up your public key in DNS and checks the signature against it.

Two values in that header matter most:

• d= is the signing domain. For DMARC to count the signature, it has to match the domain in your From address.
• s= is the selector, the label that tells receivers where your public key lives.

What the selector is

Your public key is a TXT record at selector._domainkey.yourdomain.com. The selector is a label your email platform picks, like google, s1 or scph0423.

That’s why most DKIM checkers ask for the selector before they can help. Without it, they’re guessing which record to look up.

How to find your selector

1. Open a newsletter you sent, in Gmail.
2. Open the three-dot menu and choose Show original.
3. Find the DKIM-Signature header. The selector is the s= value, and the signing domain is d=.

Or skip the hunting. Paste the whole original into a checker that reads the selector for you.

More than one key is normal

Each selector is its own record, so one domain can have several DKIM keys: one for Google Workspace, one for your newsletter platform, one for your CRM. Each service signs with its own.

Use 2048-bit keys where your DNS host supports them. 1024-bit keys still work but are weaker.

When you switch platforms

Your new platform will give you its own DKIM record. Publish it before your first send from the new platform, and leave the old record up until the last send from the old one. Removing it early means mail still going out from the old platform fails DKIM.

Check d= on your first send from the new platform too. If it shows the platform’s domain instead of yours, DKIM won’t count toward DMARC until you finish the custom-domain setup.

Frequently asked questions

Why did DKIM fail on my email? The usual reasons: the public key is missing or wrong in DNS, the selector in the signature doesn’t match a published record, or something changed the message after it was signed, like a mailing list adding a footer.

Do I need DKIM if I have SPF? Yes. Gmail and Yahoo expect both from bulk senders, and DKIM survives forwarding, where SPF often breaks.

Can I check my DKIM for free? Yes. The DKIM checker looks for your key at the common selectors, or finds yours from a pasted email, with no signup.