A DKIM public key sits at <selector>._domainkey.yourcompany.com. The selector is a name the sending service picks, so a checker can only find your key if it guesses the name or you tell it. The quickest way to learn it is from a message you've sent.
Read it from a message header
- Send an email from the account or tool you want to check to a Gmail address you can open.
- In Gmail, open the message, click the three dots next to Reply, and choose Show original. In Outlook on the web, open the message, choose the three dots, then View and View message source.
- Find the line starting
DKIM-Signature:. Inside it,d=is the signing domain ands=is the selector.
For example, DKIM-Signature: v=1; a=rsa-sha256; d=yourcompany.com; s=google; ... means the key is at google._domainkey.yourcompany.com.
Look at d= too. If it's the tool's own domain (say d=sendingtool.example) and not yours, that tool isn't signing as you yet, and its mail can't pass DMARC through DKIM. Its domain authentication setup fixes that.
Selectors common providers use
| Provider | Selector |
|---|---|
| Google Workspace | google, unless the admin chose another prefix |
| Microsoft 365 | selector1 and selector2 (CNAMEs pointing at Microsoft) |
| Zoho Mail | Whatever the admin typed when adding it, often zoho or zmail |
| Namecheap Private Email | privateemail for subscriptions bought from 2 June 2026, default before that |
| Mailchimp | k2 and k3 (CNAMEs) |
| SendGrid | s1 and s2 (CNAMEs) |
Providers change these now and then, which is why the header is the thing to trust.
Check the key is published
Put the selector in the optional box on our checker. It confirms the key exists and reports its size (2048-bit is today's recommendation; 1024-bit still passes). It also flags keys left in test mode (t=y) and revoked keys (an empty p=).
Questions people ask
Can a domain have more than one selector?
Yes, one or more per sending service. That's normal, and it's how key rotation works.
The header says dkim=pass but the checker found no key. Why?
Almost always because the selector isn't one we guess. Enter the s= value from the header and check again.
Related guides
- SPF, DKIM and DMARC for Google Workspace Records and Admin console steps for Google Workspace.
- SPF, DKIM and DMARC for Microsoft 365 Records and Defender portal steps for Microsoft 365.
- How to read a DMARC aggregate report Tell your own services from spoofing, and fix each kind of failure.
DNS only shows part of the picture. If mail is still landing in spam with every record right, the deliverability audit looks at the rest: blocklists, reputation, bounces, content and the sending setup.