DKIM selector not found
DKIM selector not found means the DNS TXT record for your DKIM selector does not exist or cannot be resolved. This causes DKIM verification to fail and can hurt email deliverability, especially when DMARC depends on DKIM alignment.
What a DKIM selector is
A DKIM selector is a label that identifies which public key to use when verifying a DKIM signature. Selectors allow a domain to have multiple active DKIM keys — for example, one per email provider.
The selector name is set by your email provider. Common examples include google, s1, selector1, or k1.
When your email provider signs outgoing messages, the selector name is included in the DKIM-Signature header. Receiving servers look up the corresponding DNS record at <selector>._domainkey.<yourdomain> to retrieve the public key and verify the signature.
Why DKIM selector lookups fail
The most common reasons a DKIM selector lookup fails are:
Missing DNS record. The TXT record at <selector>._domainkey.<domain> was never created, was deleted, or was not published correctly.
Migrating email providers without updating DNS. When you switch providers, the old selector is often removed while the new DNS record has not yet been published.
Incorrect selector in the DKIM-Signature header. The selector name in the email header does not match any DNS record on your domain.
DNS propagation delay. A newly published DKIM record may not yet be visible from all resolvers.
Common DNS mistakes
Publishing at the wrong DNS name. The DKIM record must be published at exactly <selector>._domainkey.<domain>. Publishing at _domainkey.<domain> without the selector prefix is incorrect.
Using the wrong record type. DKIM public keys must be published as TXT records. CNAME records pointing to the provider's DNS are acceptable if the provider supports them, but the final resolution must return a TXT record with v=DKIM1.
Empty or revoked key. A DKIM record with an empty p= field signals that the key has been revoked. Receiving servers will reject signatures using that selector.
Test mode flag. A record containing t=y is in test mode. Some receivers may choose to ignore the signature entirely.
How to find your DKIM selector
Your email provider should specify the selector name when setting up DKIM. Check your provider's documentation or admin panel for the DKIM configuration.
You can also find the selector by inspecting the headers of an email sent from your domain. Look for the DKIM-Signature header and find the s= tag. For example: s=google means the selector is google.
Common selector names include: google, selector1, selector2, s1, k1, dkim, mail, and default.
How to validate DKIM correctly
Once you know your selector, use MXFend's DKIM Checker to validate the DNS record. The checker verifies that the record exists, the key is not revoked or in test mode, and there are no configuration issues.
You can also manually check the record using a DNS lookup. The TXT record at <selector>._domainkey.<domain> should start with v=DKIM1 and contain a valid p= public key value.
After fixing a DKIM DNS record, allow time for DNS propagation before re-testing.
How DKIM affects deliverability
A missing or invalid DKIM selector means outgoing emails cannot be cryptographically verified. Receiving servers treat the DKIM result as a failure.
DKIM failure affects DMARC alignment. DMARC passes when at least one of SPF or DKIM passes with alignment. If DKIM fails and SPF cannot provide alignment (for example because the message was forwarded), DMARC fails.
With a DMARC policy of p=quarantine or p=reject, DMARC failure can result in spam placement or message rejection.
Frequently asked questions
What does DKIM selector not found mean?
It means the DNS TXT record at <selector>._domainkey.<domain> does not exist or cannot be resolved. DKIM verification will fail for messages signed with that selector.
Where do I find my DKIM selector?
Check your email provider's DKIM settings or documentation. You can also find the selector in the s= tag of the DKIM-Signature header in any sent email.
Can DKIM fail even if SPF passes?
Yes. SPF and DKIM are evaluated independently. A missing DKIM selector causes DKIM to fail regardless of whether SPF passes.
Does DKIM affect spam filtering?
Yes. Missing or invalid DKIM can weaken DMARC alignment and reduce sender trust, increasing the likelihood of spam placement.