What Is a DKIM Selector? How to Find, Publish and Rotate It

What a selector does

DKIM signs each outgoing message with a private key held by your mail server. The receiver verifies the signature with the matching public key, which you publish in DNS. Because one domain can have many keys — one per sending service, or an old and a new key during rotation — each key lives at its own name. The selector is that name.

The public key is published as a TXT record at selector._domainkey.yourdomain.com. If your selector is mail, receivers look up mail._domainkey.yourdomain.com. Google Workspace typically uses google, Microsoft 365 uses selector1 and selector2, and many services use their brand name or a date such as s2026. There is no standard value — each provider picks its own.

Find your selector in an email header

The fastest way to find a selector is to look at a message you sent. Open the full headers (Gmail: three-dot menu → Show original) and find the DKIM-Signature header. It looks like this: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yourdomain.com; s=mail; h=from:to:subject:date:message-id; bh=…; b=…

• d= is the signing domain. For DMARC to pass on DKIM, this must align with your From: domain.
• s= is the selector. Combine them: s=mail with d=yourdomain.com means the key is at mail._domainkey.yourdomain.com.
• a= is the algorithm, normally rsa-sha256. Some servers also sign with ed25519-sha256 (RFC 8463), usually alongside an RSA signature.
• h= lists the headers covered by the signature; bh= is a hash of the body; b= is the signature itself.
• A message can carry several DKIM-Signature headers — for example one from your provider and one from a forwarding service. Check that at least one has your own domain in d=.

What the DNS record looks like

The TXT value at the selector name is a set of tags, for example: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…

v=DKIM1 is the version, k=rsa the key type and p= the base64 public key. You may also see t=y, which marks the key as being in testing — receivers may then treat failures more leniently. Remove t=y once DKIM is working.

Some providers ask you to publish a CNAME instead of a TXT, pointing selector._domainkey.yourdomain.com to a record they host. That lets them rotate keys without you editing DNS. Either is fine; do not publish both at the same name.

1024-bit vs 2048-bit keys, and long TXT records

A 1024-bit RSA key is the minimum that receivers accept and is now considered weak. 2048-bit is the current recommendation and is what Google and most providers generate. Keys shorter than 1024 bits are ignored by major receivers, so a 512-bit key effectively means no DKIM.

A 2048-bit public key is about 400 characters, but a single DNS TXT string can only hold 255. The record must therefore be split into multiple quoted strings within one TXT record, for example "v=DKIM1; k=rsa; p=MIIBIjANBg…" "…IDAQAB". Receivers join the strings with no spaces. Most DNS dashboards (Cloudflare, Namecheap and others) split automatically when you paste the full value; some older panels need you to add the quotes yourself.

Common breakages when pasting: a line break or space inserted in the middle of the key, a missing final character, or the panel appending your domain so the name becomes mail._domainkey.yourdomain.com.yourdomain.com. Look the record up after saving to make sure it resolves exactly as given.

Rotating DKIM keys safely

Rotating keys periodically — many organisations aim for every 6 to 12 months, or immediately if a private key may have leaked — limits the damage if a key is compromised. Selectors make it seamless:

• Generate a new key pair and publish its public key at a new selector, such as s2027._domainkey.yourdomain.com.
• Wait for DNS to propagate and confirm the new record resolves.
• Switch your mail server to sign with the new selector. New messages now carry s=s2027.
• Keep the old selector published for at least a few days, ideally a week, so messages still in transit or queued for retry can be verified.
• Revoke the old key by publishing it with an empty p= (v=DKIM1; p=), or delete the record.

An empty p= means revoked

If a DKIM lookup returns v=DKIM1; p= with nothing after p=, that key has been deliberately revoked. Any message signed with that selector will fail DKIM with a "key revoked" result. If you see this on your current selector, your mail server is still signing with a retired key — update the signing configuration or republish the key.

With HavitoMail, a 2048-bit DKIM key is generated for each domain you add and every outbound message is signed with it; the DNS wizard shows the exact selector name and value to publish and confirms when receivers can see it. You can also check any selector with our free DNS checker.