Finding your DKIM selector
A DKIM public key lives at <selector>._domainkey.example.com. DNS has no way to list selectors, so checkers either guess common ones or need you to supply yours.
Fastest way: read a message header
Open a message you sent, view the original/raw source, and find DKIM-Signature:. The s= tag is the selector and d= is the signing domain.
Common provider selectors
| Provider | Typical selector(s) |
|---|---|
| Google Workspace | google (configurable) |
| Microsoft 365 | selector1, selector2 |
| Zoho Mail | zoho or custom |
| Fastmail | fm1, fm2, fm3 |
| Proton Mail | protonmail, protonmail2, protonmail3 |
| SendGrid | s1, s2 |
| Amazon SES | random tokens (see the SES console) |
Test any selector: checker with the selectors field, or GET /v1/email-auth?domain=example.com&selectors=s1,s2. Keys under 1024 bits are flagged (Yahoo asks for at least 1024).