How do I find my DKIM selector?

Look at the DKIM-Signature header of a message your domain sent; the s= tag is the selector. AstraVerify checks about 80 common selectors from DNS and can read the real one if you send a single email from your domain to the address it gives you.

Can a domain have more than one DKIM record?

Yes. Each is under its own selector, so several providers and old/new keys can coexist. Only the selector named in a message’s signature is used to verify that message.

Does DKIM encrypt my email?

No. DKIM is a signature that proves origin and integrity; the content is not encrypted by DKIM.

Why does DMARC fail when DKIM passes?

Because the signing domain does not match the From domain (no alignment). Configure your sending service to sign with your own domain.

What is DKIM?

DKIM (DomainKeys Identified Mail) lets a mail server add a digital signature to each outgoing message. The signature covers the message body and selected headers, and is created with a private key held by your mail provider. The matching public key is published in your DNS, so any receiving server can verify that the message really came from an authorised sender and was not altered in transit.

Unlike SPF, DKIM survives forwarding: the signature stays valid no matter which server relays the message, which is why DMARC alignment usually relies on DKIM in practice.

Selectors: where the key lives in DNS

A domain can have many DKIM keys at once (one per provider, or old and new during rotation). Each key is published under a selector name: the record lives at <selector>._domainkey.<domain>. The signature header on each message names the selector used (the s= tag), so the receiver knows which key to fetch.

Selectors are not listed anywhere in DNS. Google Workspace uses "google", Microsoft 365 uses "selector1" and "selector2", but Amazon SES, Postmark and many others generate random selector names. A scanner can only guess common names; the only certain way to see the selector in use is to inspect a real message.

Example record

Name: google._domainkey.example.com
Type: TXT
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...

Key length: 1024 vs 2048 bits

1024-bit RSA keys were the default for years and are still common. They are now considered weak: some large receivers already treat 1024-bit signatures as unverified. Generate 2048-bit keys, and if your DNS provider limits TXT record length, split the value into multiple quoted strings rather than shortening the key.

DKIM alignment and DMARC

DMARC passes on DKIM when the signing domain (the d= tag in the signature) matches the From domain. If your email service signs with its own domain instead of yours (for example d=amazonses.com), the signature verifies but does not align, and DMARC treats the message as unauthenticated. Always configure the service to sign with your domain.

Common DKIM problems

DKIM never enabled: the provider offers it but it was not switched on, so mail is unsigned.
Record published but the provider not told to start signing (Google requires a "Start authentication" step).
Signing with the provider’s domain rather than yours, so DMARC does not align.
1024-bit keys, or keys that were never rotated.
A wildcard *._domainkey record that makes every selector "exist"; harmless but hides real configuration.

Frequently asked questions

How do I find my DKIM selector?: Look at the DKIM-Signature header of a message your domain sent; the s= tag is the selector. AstraVerify checks about 80 common selectors from DNS and can read the real one if you send a single email from your domain to the address it gives you.
Can a domain have more than one DKIM record?: Yes. Each is under its own selector, so several providers and old/new keys can coexist. Only the selector named in a message’s signature is used to verify that message.
Does DKIM encrypt my email?: No. DKIM is a signature that proves origin and integrity; the content is not encrypted by DKIM.
Why does DMARC fail when DKIM passes?: Because the signing domain does not match the From domain (no alignment). Configure your sending service to sign with your own domain.

Check your own domain. The scan shows your live records, a score out of 100 and the exact record to publish for each fix.