# What Is DKIM, and Where Is Your Selector? Source: https://www.tryletterhead.com/blog/what-is-dkim.html DKIM is the signature on your email. Every message you send carries one, and receivers check it against a public key you publish in DNS. If the signature checks out, they know the message really came from your domain and wasn't changed on the way. Gmail and Yahoo have expected DKIM from bulk senders since February 2024, alongside SPF and DMARC. Outlook.com has rejected bulk mail that fails them since May 2025. ## How DKIM works Your email platform holds a private key and uses it to sign each message as it goes out. The signature travels in a header called DKIM-Signature. When Gmail receives the message, it looks up your public key in DNS and checks the signature against it. Two values in that header matter most: - d= is the signing domain. For DMARC to count the signature, it has to match the domain in your From address. - s= is the selector, the label that tells receivers where your public key lives. ## What the selector is Your public key is a TXT record at selector._domainkey.yourdomain.com. The selector is a label your email platform picks, like google, s1 or scph0423. That's why most DKIM checkers ask for the selector before they can help. Without it, they're guessing which record to look up. ## How to find your selector - Open a newsletter you sent, in Gmail. - Open the three-dot menu and choose **Show original**. - Find the DKIM-Signature header. The selector is the s= value, and the signing domain is d=. Or skip the hunting. Paste the whole original into a checker that reads the selector for you. _Free tool · DKIM checker_ Find your DKIM selector and check your key. Type your sending domain, or paste an email you sent and we read the selector from its signature. No signup. [Check your DKIM](../tools/dkim-checker.html) ## More than one key is normal Each selector is its own record, so one domain can have several DKIM keys: one for Google Workspace, one for your newsletter platform, one for your CRM. Each service signs with its own. Use 2048-bit keys where your DNS host supports them. 1024-bit keys still work but are weaker. ## When you switch platforms Your new platform will give you its own DKIM record. Publish it before your first send from the new platform, and leave the old record up until the last send from the old one. Removing it early means mail still going out from the old platform fails DKIM. Check d= on your first send from the new platform too. If it shows the platform's domain instead of yours, DKIM won't count toward DMARC until you finish the custom-domain setup. ## Frequently asked questions **Why did DKIM fail on my email?** The usual reasons: the public key is missing or wrong in DNS, the selector in the signature doesn't match a published record, or something changed the message after it was signed, like a mailing list adding a footer. **Do I need DKIM if I have SPF?** Yes. Gmail and Yahoo expect both from bulk senders, and DKIM survives forwarding, where SPF often breaks. **Can I check my DKIM for free?** Yes. The [DKIM checker](../tools/dkim-checker.html) looks for your key at the common selectors, or finds yours from a pasted email, with no signup. #deliverability #dkim #how-to _Keep reading_ ## More on this topic. [Why Gmail Clips Your Newsletter (and How to Stay Under 102KB) Gmail cuts off emails with more than about 102KB of HTML, hiding your last stories and your unsubscribe link. What makes newsletters heavy and how to slim them down. Read the post](../blog/gmail-clipping-newsletter.html)[Hard Bounce vs. Soft Bounce: What Each One Does to Your List A hard bounce means the address is gone for good; a soft bounce means try again later. What causes each, what to do about them, and how to keep bad addresses off your list. Read the post](../blog/hard-bounce-vs-soft-bounce.html)[SPF for Newsletters: One Record, Every Sender Listed SPF lists the servers allowed to send mail as your domain. How a record is built, the one-record rule, the 10-lookup limit, and what your newsletter platform needs from it. Read the post](../blog/spf-record-newsletters.html) ## Get the Letterhead newsletter. Original analysis on newsletters, weekly. From the team that runs the operating system. [Subscribe](../blog/) [See past issues](../blog/)