Which DKIM selector should I enter in the DKIM Checker?

A DKIM selector is the label that identifies which key in DNS the receiving server should use to verify a signature. DKIM records live at <selector>._domainkey.<your-domain>, so each ESP publishes its public key under whatever selector it chose. There is no single right answer to "which selector should I enter" — it depends on which ESP signs your outbound mail. The DKIM Record Checker accepts any selector, but knowing the common ones up front saves a round trip.

Common ESP selectors

How to find yours if it is not on the list

Three reliable ways to find your selector:

• Check your ESP's DKIM settings page. Every major ESP shows the selector and the public key it expects you to publish. Search their docs for "DKIM" or "domain authentication".
• Read the DKIM header of an email you sent. Open a delivered message, view full headers, find the DKIM-Signature header. The s= tag is the selector (e.g. s=google, s=selector1).
• Use the checker's Auto-detect. It probes the eight most common selectors in sequence and returns the first one that resolves. Works for most Google/Microsoft/Mailchimp setups.

When auto-detect is enough

Auto-detect catches Google Workspace, Microsoft 365, Mailchimp, and any domain using one of the small set of generic selectors (default, mail, dkim, smtp, k1). For Amazon SES, Postmark, HubSpot, and similar providers that use hashed or dated selectors, auto-detect will not work — type the selector explicitly. The other DNS tools on Valid Email Checker (SPF, DMARC) do not have this problem because they live at fixed paths.

Domains with multiple selectors

Microsoft 365 publishes two selectors (selector1 and selector2) on purpose, so it can rotate keys without service interruption. Any domain using multiple ESPs has at least one selector per ESP. The checker shows one selector at a time — check each separately. As long as the active selector on outbound mail resolves, the email passes DKIM.