In order to perform a DKIM record check, the DKIM selector is needed. In this article we will cover two methods to find out what DKIM selector is used for a specific source.
With DKIM, organizations can authenticate their emails in order to protect their email. Find more information about what DKIM is on our website. A DKIM selector is part of the DKIM record and it allows publishing multiple DKIM keys on domains. Once the selector and the associated domain are in place, they will need to be validated. The DKIM record check of DMARC Analyzer shows if there is a valid or invalid DKIM key record. In order to perform a DKIM record check, the DKIM selector is needed.
Who provides the DKIM selector?
The DKIM selector that needs to be used, depends on the source where DKIM has to be setup for. Most of the times, the source for which DKIM has to be setup, mentions the selector in their documentation. For some sources it is possible to pick a custom selector, but this depends on the options the specific sender has. Furthermore other senders may require on organization to publish multiple selectors on their domains, for instance to support automated DKIM key rotation through CNAME records.
How to find a DKIM selector for an existing DKIM supported mail flow?
It is possible to find out what DKIM selector a certain source uses by sending yourself an email via that source. The steps below show how to find a DKIM selector via sending yourself an email.
- Send an email to yourself
Send an email to yourself via the source that you want to know the DKIM selector of.
- View the ‘original message’ / ‘view mail headers’ / ‘raw message’
When you open the email, view the ‘original message’ of the email. Doing so a lot of information of the message can be viewed, including the authentication results of DKIM.
- Search for the selector
Search for ‘DKIM-Signature’ to find the DKIM signature applied to the message. This DKIM-Signature contains an attribute ‘s=’ which is the selector used. In the example below we can see the DKIM selector is ‘google’.
How to find the DKIM selector via the DMARC Analyzer Suite?
Within the DMARC Analyzer Suite it is possible to see the DKIM selector a source uses. This is shown at multiple places, in the steps below we describe the easiest way to find the DKIM selector within the DMARC Analyzer Suite.
- Login to the DMARC Analyzer Suite
- Go to the ‘Per host’ overview of the DMARC aggregate reports
This overview shows all sources sending email on behalf of a certain domain or domains.
- Select the desired source and expand the rows
Expand the rows of the source for which the DKIM selector is being searched. - Look for the DKIM selector in the ‘DKIM verification’ column
Within the DKIM verification column is it possible to view the DKIM selector. This is shown in the image below: In this example we can see that the DKIM selector for Example1.com is Test 1.