DKIM selectors by provider: the reference list
To look up a DKIM record you need two things: the domain and the selector — the label the sender chose for the key, published at selector._domainkey.domain. Providers each use their own convention, and finding the right one is half the battle when a DKIM check fails. Here's the list.
Updated July 25, 2026
Selectors for major providers
| Provider | Selector(s) | Record type | Notes |
|---|---|---|---|
| Google Workspace | google | TXT | Generated in the Admin Console; setup guide |
| Microsoft 365 | selector1, selector2 | CNAME | Targets embed your tenant; setup guide |
| Zoho Mail | you choose (zmail is a common default) | TXT | Named when generating the key; setup guide |
| Amazon SES | three randomized selectors | CNAME | Easy DKIM issues them per identity; setup guide |
| SendGrid | s1, s2 | CNAME | Plus an em CNAME for the return path; setup guide |
| Mailgun | smtp or k1 | TXT | On your sending subdomain (e.g. mg); setup guide |
| Postmark | timestamp + pm (e.g. 20260713120000pm) | TXT | Unique per account, shown on the DNS settings page; setup guide |
| Brevo | mail | TXT | Setup guide |
| Mailchimp | k2, k3 | CNAME | Setup guide |
| Klaviyo | kl | CNAME | On the send subdomain Klaviyo provisions; setup guide |
| HubSpot | hs1-<id>, hs2-<id> | CNAME | Your account number is in the selector; setup guide |
| Instantly.ai | instantly | TXT | Setup guide |
| Customer.io | krs | CNAME | On your cio sending subdomain; setup guide |
| Resend | resend | TXT | Setup guide |
| GoHighLevel | shown in the connect wizard | CNAME | On the mail subdomain; setup guide |
| ActiveCampaign | shown in the connect wizard | CNAME | Issued per account during domain setup; setup guide |
How to find the selector for any email
Every DKIM-signed message declares its selector in the signature itself. Open the message's raw source (Gmail: three-dot menu → Show original) and find the DKIM-Signature header — the s= tag is the selector and d= is the signing domain.
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=s1;
h=from:to:subject; bh=…; b=…Or skip the manual digging: paste the full headers into our header analyzer and it extracts the signing domain, selector, and verification result. Then confirm the published key with the DKIM checker.
When the selector lookup fails
- Wrong selector: the platform rotated keys or you're checking a default that your account doesn't use. Pull the real selector from a message header as above.
- Record published at the wrong host: registrars that auto-append the domain turn
s1._domainkey.example.cominto a doubled hostname — enter onlys1._domainkeyin the host field (see our GoDaddy and Namecheap guides). - Proxied CNAME: on Cloudflare, a DKIM CNAME left on Proxied is invisible to mail servers — set it to DNS only.
- Propagation: freshly added records can take up to an hour at most hosts. Re-check before re-editing.