How do I find the DKIM selector for my domain in Dmarcian or Hubspot?

Summary

Finding the DKIM selector for your domain involves several methods, most of which are dependent on the email service provider you are using. For HubSpot users, the selector can be found in Settings > Domains & URLs under the DKIM section. You can find the DKIM selector by inspecting the DKIM-Signature header of sent emails, looking for the 's=' tag. This is further backed up with the information that the selector identifies the public key for DKIM verification. Additionaly tools and services are availabe that can support this action, examples include Wombatmail, dig, nslookup and MXToolbox.

Key findings

  • HubSpot Settings: HubSpot users can find the DKIM selector under Settings > Domains & URLs in the DKIM section.
  • Email Header Inspection: The DKIM-Signature header contains the selector, indicated by the 's=' tag.
  • Identifies Public Key: The selector is a string used to identify the public key for DKIM signature verification.
  • Reliance on Service Provider: Consulting your email service provider's configuration or documentation is a reliable method.
  • Available Tools: Tools are available to help assist in finding the selector and include the use of Wombatmail, dig, nslookup and MXToolbox.

Key considerations

  • Service Dependency: The method for finding the DKIM selector depends heavily on the specific email service provider.
  • Varying Methods: Different email providers (HubSpot, Microsoft, Google, Cloudflare) require different approaches (settings, PowerShell, admin console).
  • Underlying Knowledge: Inspecting email headers and using command-line tools requires some technical expertise.
  • Selector String: It's a short string of alphanumeric characters (e.g., 's1', 'default').

What email marketers say
10Marketer opinions

Finding your DKIM selector involves several methods depending on your email service provider and access level. If using HubSpot, the selector should be available in your account settings. For Dmarcian, you can inspect the DKIM-Signature header of sent emails, looking for the 's=' tag. Other methods include checking your cPanel's Email Deliverability section, using command-line tools like `dig` or `nslookup`, or utilizing online tools like MXToolbox's DKIM Lookup. Third-party email services like Postmark generally provide the selector, and it's a string identifying the key used to sign the email, enabling multiple DKIM keys for a single domain.

Key opinions

  • HubSpot Settings: If you are using HubSpot, the DKIM selector can typically be found within your account settings.
  • Email Header Inspection: The DKIM-Signature header of an email sent from your domain contains the selector, indicated by the 's=' tag.
  • cPanel Access: If you have access to cPanel, the DKIM selector can be found within the Email Deliverability section.
  • Command-Line Tools: Tools like `dig` and `nslookup` can be used to query the DKIM record and reveal the public key associated with the selector.
  • Online Lookup Tools: MXToolbox offers a DKIM Lookup tool where you can input your domain and selector to verify the record.
  • Service Provider Documentation: Email service providers generally provide a selector and documentation on how to use it.

Key considerations

  • Service Provider Dependency: The method for finding your DKIM selector largely depends on your email service provider (e.g., HubSpot, Postmark).
  • Access Levels: Finding the DKIM selector may require different access levels, such as access to cPanel, command-line tools, or specific account settings.
  • Selector Purpose: The DKIM selector allows for multiple DKIM keys to be used for a single domain, identifying which key was used to sign a particular email.
Marketer view

Email marketer from Reddit shares that if you have access to cPanel, you can find the DKIM selector within the Email Deliverability section. It's typically auto-generated but you can view it there.

March 2025 - Reddit
Marketer view

Marketer from Email Geeks responds that HubSpot should be able to provide the DKIM selector.

September 2024 - Email Geeks
Marketer view

Email marketer from AuthSMTP explains that a DKIM selector allows for multiple DKIM keys to be used for a single domain. The selector is a string that identifies which key was used to sign a particular email.

November 2022 - AuthSMTP
Marketer view

Email marketer from EasyDMARC explains the DKIM selector is part of the DKIM signature that helps verify that an email message wasn’t altered during transit. It will allow you to verify the DKIM record.

March 2022 - EasyDMARC
Marketer view

Email marketer from Postmark says that when setting up DKIM, you generally provide a selector. If you’re using a third-party email service, they should provide the selector to use in your DNS records.

August 2024 - Postmark
Marketer view

Email marketer from Dmarcian shares that you can determine the DKIM selector by inspecting the DKIM-Signature header of an email sent from your domain. The 's=' tag indicates the selector.

November 2022 - Dmarcian
Marketer view

Email marketer from StackOverflow responds that you can look up the DKIM record using `dig` or `nslookup` commands, specifying the selector and domain in the query. This will reveal the public key associated with that selector.

May 2023 - StackOverflow
Marketer view

Email marketer from MXToolbox shares that you can use the MXToolbox DKIM Lookup tool to check your DKIM record. Input the domain and selector to verify the record's validity.

January 2025 - MXToolbox
Marketer view

Email marketer from SuperOffice explains that the selector is used to locate the public DKIM key, and is specified in the DKIM signature of the email header. To locate the selector, check with your email sending service provider.

September 2023 - SuperOffice
Marketer view

Marketer from Email Geeks explains that Dmarcian can't possibly know all DKIM selectors and you either need to send an email or provide the selector to query and test it. Also, the word to the left of `._domainkey` in the DNS record can identify it.

December 2024 - Email Geeks

What the experts say
4Expert opinions

Finding the DKIM selector for your domain involves inspecting email headers or checking with your email sending service. The selector, often a short string like 's1' or 'default', identifies the public key for DKIM signature verification. The DKIM-Signature header contains the 's=' value, indicating the selector. Alternatively, some tools like Wombatmail can attempt to identify the selector, though their capabilities are limited to pre-programmed possibilities. Ultimately, the most reliable method is to consult your email service provider's documentation or configuration settings.

Key opinions

  • Email Header Inspection: The DKIM signature header contains the selector, identified by the `s=` value.
  • Purpose of Selector: The DKIM selector is a string used to identify the public key needed for DKIM signature verification.
  • Service Provider Reliance: Email sending service documentation or configuration is the typical place to find your DKIM selector.
  • Selector String: DKIM selectors are alphanumeric strings, often short, e.g. `s1` or `default`.

Key considerations

  • Technical Expertise: Inspecting email headers requires some level of technical understanding.
  • Tool Limitations: Automated tools for DKIM selector identification may not be comprehensive.
  • Service Provider Variation: The exact method for locating the DKIM selector varies depending on the email service provider.
Expert view

Expert from Email Geeks explains that you can find the selector by looking at the DKIM signature in the header and finding the s= value.

November 2021 - Email Geeks
Expert view

Expert from Email Geeks shares a tool, Wombatmail, that tries a bunch of possible selectors if you don't enter one, but it's only smart enough to catch ones it has been programmed to know about.

December 2024 - Email Geeks
Expert view

Expert from SpamResource explains that the DKIM selector is a string that is used to identify the public key that is used to verify the DKIM signature. The selector is usually a short string of alphanumeric characters, such as 's1' or 'default'. You can find the selector in the DKIM-Signature header of an email.

September 2022 - SpamResource
Expert view

Expert from Word to the Wise explains that to locate your DKIM selector, you typically need to check your email sending service's configuration or documentation. The selector is used when querying the DNS record to retrieve the public key for DKIM verification.

May 2024 - Word to the Wise

What the documentation says
4Technical articles

Finding the DKIM selector depends on your email service provider. HubSpot displays the selector in Settings > Domains & URLs within the DKIM section. Microsoft 365 requires using the `Get-DkimSigningConfig` PowerShell cmdlet. Google Workspace automatically generates the selector, accessible in the Admin console under Apps > Google Workspace > Gmail > Authenticate email. Cloudflare provides the selector when DKIM signing is enabled, requiring you to add the DKIM record to your DNS settings.

Key findings

  • HubSpot Location: In HubSpot, the DKIM selector is found under Settings > Domains & URLs.
  • Microsoft 365 Method: Microsoft 365 uses PowerShell cmdlets to retrieve DKIM selectors.
  • Google Workspace Generation: Google Workspace automatically generates the DKIM key and selector.
  • Cloudflare Provision: Cloudflare provides the DKIM selector upon enabling DKIM signing.

Key considerations

  • Service Specific Instructions: Each email service provider has a unique method for locating the DKIM selector.
  • Admin Access Required: Accessing DKIM selectors generally requires administrator-level permissions within the email service.
  • DNS Record Updates: After obtaining the DKIM selector, you may need to update DNS records to enable DKIM signing.
Technical article

Documentation from HubSpot explains that you can find your DKIM selector in your HubSpot account under Settings > Domains & URLs. The selector is displayed in the DKIM section for your connected domain.

September 2022 - HubSpot
Technical article

Documentation from Microsoft explains that in Microsoft 365, you can find DKIM selectors by using PowerShell cmdlets like `Get-DkimSigningConfig`. This will display the selectors configured for your domain.

February 2024 - Microsoft
Technical article

Documentation from Google explains that when you set up DKIM for Google Workspace, Google automatically generates the DKIM key and selector. You can find the selector in the Admin console under Apps > Google Workspace > Gmail > Authenticate email.

May 2024 - Google
Technical article

Documentation from Cloudflare explains that when you enable DKIM signing with Cloudflare, they provide the selector. You'll need to add the provided DKIM record (which includes the selector) to your DNS settings.

December 2021 - Cloudflare