“DKIM selector not found” — what it means

Unlike SPF and DMARC, DKIM has no fixed location in DNS. The key lives at <selector>._domainkey.yourdomain.com, and the selector is an arbitrary string your mail provider chose. A checker cannot find your key unless it guesses that string.

So “selector not found” usually means the checker guessed wrong — not that DKIM is broken. MailGate probes 22 common selectors in parallel, which catches most real-world setups.

Common selectors by provider

Find your real selector in 30 seconds

Send yourself a message, then open the raw source (Gmail: Show original; Outlook: View message source). Find the header:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
    d=example.com; s=google; t=1699999999;

s= is your selector. d= is the signing domain. Now query it:

dig TXT google._domainkey.example.com +short

A record starting v=DKIM1; k=rsa; p=MIIBIjAN... means DKIM is published correctly.

When it is genuinely broken

• Empty p= tag — v=DKIM1; p= is a revoked key. Every signature against it fails. Re-publish the real key.
• CNAME not followed — SES/Mailgun hand you CNAMEs. Some DNS panels silently mangle them; verify the target resolves.
• Key too short — 1024-bit still works but is deprecated; rotate to 2048.
• Signed by the vendor's domain — if d= is your vendor rather than you, DKIM passes but does not align, so DMARC still fails. Set up custom DKIM signing.

Related guides

• SPF "too many DNS lookups" — how to fix the 10-lookup limit
• DMARC p=none vs quarantine vs reject — which policy to use
• Google & Yahoo bulk sender requirements — the 2024 rules, still enforced
• Why your email goes to spam — a diagnostic order of operations
• How to set up DMARC — a step-by-step record you can copy

MailGate — free SPF, DKIM & DMARC checker. Check any domain →