Tools
DKIM record checker
Look up a DKIM record for any domain. Follows CNAME chains automatically (M365, SendGrid, Mailgun-style indirection), distinguishes revoked selectors from broken ones, and auto-tries common selectors when yours is not found.
What is a selector?
A DKIM selector is a short label that picks which key to verify against, since a single domain can publish many DKIM keys at once (one per provider, one per rotation, one per environment). The DNS record always lives at <selector>._domainkey.<domain>. The selector name itself is chosen by whoever runs your outbound mail — there is no universal default, which is why this checker has to be told which selector to look up.
The fastest way to find your live selector: open any recently-sent email, view the raw source / "Show original", and grab the s= tag from the DKIM-Signature header. That is the selector your provider is actually publishing today.
Common selectors by provider
| Provider | Selectors | Note |
|---|---|---|
| Google Workspace (your-domain.com) | Default selector for Workspace tenants. Admins can change it. | |
| Google corporate (google.com itself) | 20XXMMDD | Google rotates date-based selectors for its own mail. Check the DKIM-Signature s= header on a real message to see the current one. |
| Microsoft 365 / Exchange Online | selector1, selector2 | Always exactly these two. Both are CNAMEs pointing at *.onmicrosoft.com. |
| SendGrid | s1, s2, em1, em2, em<N> | Per-account selectors. em<N> values are assigned per subuser. |
| Mailgun | mg, k1, pic, mailgun | "mg" is the modern default; older domains may still use "pic" or "k1". |
| Postmark | pm, 20XXMMDD | Postmark sometimes rotates date-based selectors alongside "pm". |
| Amazon SES | <22-char-tenant-id> | SES auto-generates a unique identifier per verified domain. Look at the DNS records SES gave you. |
| Resend | resend | Single fixed selector across all customer domains. |
| Zoho Mail | zoho, zmail | |
| Apple iCloud Mail | sig1 | |
| MailChimp / Mandrill | k1, k2 | |
| Brevo (SendinBlue) |
What we check
- CNAME chain following — providers like Microsoft 365, SendGrid, and Mailgun CNAME the selector to keys they manage centrally. We follow up to 5 hops and surface the chain.
- Revocation detection — empty
p=is a deliberate revocation marker, not a bug. We distinguish revoked selectors from malformed ones. - Key size estimation — derived from the base64-encoded public key. 1024 is the floor; 2048 is recommended.
- Testing mode —
t=ytells receivers to ignore failures. Useful for staging, dangerous in prod. - Hash algorithm —
h=sha1is deprecated; receivers may drop signed mail. Prefersha256. - Auto-discovery — when your selector returns nothing, we try 20 common selectors in parallel and surface any that resolve.
Tired of debugging DKIM by hand?
SNDR generates a fresh RSA-2048 keypair the moment you add a sending domain, gives you the exact TXT record, and re-verifies on every send. Start free.