Email & DNS guide
DKIM selectors and signatures explained
Find your selector, check its public key, and understand what a DNS lookup can and cannot prove.
A signature and a public key
Your sending system signs selected message data with a private key. A receiver retrieves the matching public key from DNS to verify the signature. Never publish a private key in DNS or paste it into a checker. Your mail provider normally manages the private key.
Locate the exact selector
Open the original headers of a recent message and find DKIM-Signature. Use the s value as the selector and the d value as the signing domain. Together they identify selector._domainkey.domain. A single domain can have several selectors for different providers or key rotations.
What the lookup proves
A DNS lookup can establish that a key is published at a selector and inspect its format. It cannot establish that your sending service is signing messages correctly. A missing guessed selector says little about other selectors. An empty p value indicates revocation rather than an active public key.
Confirm the complete path
Enable signing using your provider's instructions, send a fresh message, and inspect Authentication-Results at the receiver. Check dkim=pass and the signing domain. For DMARC, the signing domain must also align with the visible From domain. Keep old selectors for the transition period recommended by your provider.
Primary references
Provider dashboards and instructions can change. Confirm current values with your provider before editing DNS.