Free tools · Email domain setup
How to Find Your DKIM Selector
A DKIM selector tells a receiver which public key to look up. Find it in a received message's DKIM-Signature header or in your sending provider's setup. A guessed selector can return no key even when the service signs correctly.
Real public DNS lookup. No signup, mailbox connection or API key needed.
Check your published DKIM record
Enter your own public domain and actual selector. The illustrated examples below are not preloaded and no lookup runs until you submit.
Look up your public DKIM record.
Enter your domain and its DKIM selector to see the published record and any issues found. Results appear here after a real DNS lookup.
What to do next
1. Open a received message's headers
Use your mail app's original-message or full-header view for a message sent by the service you want to inspect. Different sending services can use different signatures.
2. Read s= and d= together
Within one DKIM-Signature field, s= supplies the selector and d= the signing domain. Keep those values from the same signature if the message has several signatures.
3. Enter those two values
Enter only the signing domain in Public domain and only the selector in DKIM selector. The checker constructs selector._domainkey.domain; do not paste the entire hostname into the selector field.
4. Review the key and message separately
Read the DNS key findings, then review the receiver's reported authentication result for that message. Finding a parseable public key is not the same as verifying the message's signature.
A shortened fictional signature header
DKIM-Signature: ... d=example.com; s=mail2026; ... Public domain: example.com DKIM selector: mail2026 DNS name: mail2026._domainkey.example.com
The omitted signature data makes this an illustration, not a valid signed message. Neither mail2026 nor example.com is a value to assume for your own provider.
Keys can rotate
A provider can change the active selector over time. An old message may name a key that has been removed or revoked. Use a recent representative message when checking current sending.
The signing domain can differ
A service can sign with its own domain as well as a customer domain. DKIM's signing identity and DMARC alignment are separate questions; inspect the actual domains instead of assuming they match.
Questions
Is the selector always google or selector1?
No. Those are common examples, not universal values. Read the actual s= field or the provider's configuration for your domain.
What does an empty p= key mean?
An empty p= value explicitly revokes that selector's key. Ask the sending provider for the current selector and published public key; do not insert a generated replacement yourself.
Checking sends your public domain and selector to AskQuokka. Record generation and copying run in this tab. No DNS settings are changed and no email is sent. Domain inputs and lookup results are not included in tool analytics.
Official references
References checked 23 October 2026. Use your provider's current domain-specific values.
More setup and troubleshooting guides
Google Workspace DKIM Setup and Selector Check
Review Google Workspace DKIM setup, publish the Admin console's public key and check the actual selector. No Google connection is needed for DNS checks.
Microsoft 365 DKIM: CNAME and Selector Guide
Understand Microsoft's two DKIM selectors, copy the tenant-specific CNAME targets and check the selected signing key. Free domain and selector lookup.