DKIM selector cheat sheet
Every ESP signs your mail with a different DKIM selector. Here's a reference of the common ones, plus the dig/curl commands to pull the records yourself.
Why selectors exist
The selector is the s= tag in the DKIM-Signature header. It tells receivers which DNS record to look up: <selector>._domainkey.<your-domain>. By using different selectors per service and per rotation, you can publish multiple keys at once and roll over without downtime.
Selectors by provider
| Provider | Selector(s) | DNS query |
|---|---|---|
| Google Workspace / Gmail | google, 20230601 | dig TXT google._domainkey.example.com |
| Microsoft 365 | selector1, selector2 | dig TXT selector1._domainkey.example.com |
| SendGrid | s1, s2, smtpapi | dig TXT s1._domainkey.example.com |
| Mailchimp / Mandrill | k1, k2, k3 | dig TXT k1._domainkey.example.com |
| Mailgun | mailo, smtp | dig TXT mailo._domainkey.example.com |
| Amazon SES | amazonses + 3 CNAMEs you set up at verification time | dig TXT amazonses._domainkey.example.com |
| Postmark | 20161025, pm | dig TXT 20161025._domainkey.example.com |
| HubSpot | hs1-<hubid> + numbered ones | dig TXT hs1-123._domainkey.example.com |
| Klaviyo | klaviyo, kl1 | dig TXT klaviyo._domainkey.example.com |
| Zoho Mail | zoho, zmail | dig TXT zoho._domainkey.example.com |
| Proton Mail | protonmail, protonmail2, protonmail3 | dig TXT protonmail._domainkey.example.com |
| iCloud Mail | sig1 | dig TXT sig1._domainkey.example.com |
What if you don't know the selector?
Inspect the DKIM-Signature: header on a message you've already sent. The s= tag is the selector. If you can't get a sample, the DKIM Selector Finder probes 50+ common selectors automatically in parallel.