Domain health guide
What is a DKIM selector?
A DKIM selector identifies one DKIM key record for a sending system. It lets a domain rotate or use more than one signing key without replacing every record at once.
Use the DKIM CheckerHow a selector fits into DKIM
DKIM uses a selector together with the domain to locate a public DNS record. A provider might use a selector such as google or selector1, producing a lookup name like selector1._domainkey.example.com.
The selector is chosen by the sender or email provider. It is not a value to guess from a domain name, and different providers can use different selectors for the same domain.
Where to find a known selector
Use the email provider's setup documentation or the DNS configuration created during provider setup. For mail you are authorized to inspect, a sent message's DKIM-Signature or Authentication-Results headers can also identify the selector.
Do not upload email messages or private headers to a public checker. The CloudSpex tool accepts a domain and one selector, then reads the relevant public DNS record.
Validate one selector at a time
A selector-specific check can confirm whether the public record is available and safely interpretable. It cannot prove that every message from the domain is signed correctly or that every mail provider is configured as intended.
Check the selector used by each sending system, especially after an email-provider migration, DNS change, or key rotation.
- Identify the sender or provider you are checking.
- Find its documented selector.
- Check that one selector against the sending domain.
- Review provider setup when the record is missing, invalid, or revoked.
- Recheck after a DNS or key-rotation change.
Avoid selector guesswork
Trying common selectors across a domain is not a reliable configuration review. It can miss the actual key and creates unnecessary lookup attempts.
CloudSpex validates one selector per request and does not perform automatic selector discovery or brute-force lookup.
Frequently asked questions
Is a DKIM selector secret?
No. The selector and public key record are published in DNS, but private signing keys must remain private.
Can a domain use more than one selector?
Yes. Multiple senders or key-rotation stages can use different selectors.
Does a present DKIM record prove mail delivery?
No. It confirms only the relevant public record can be assessed; mail flow also depends on signing and receiver-side evaluation.
Use public checks as a starting point
CloudSpex reads limited public-facing signals. It does not change DNS, website, certificate, or email settings. Confirm the responsible provider and test relevant changes before applying a remediation.