How do I find my DKIM selector?

Open an email you sent in Gmail, choose "Show original", and look for the DKIM-Signature header. The value after s= is the selector, and d= is the domain that signed it.

Can Warnwell check a selector I name?

Not yet. It tries your provider's names and about 20 common ones. If you use Amazon SES or another sender with its own selector names, the result says the key may exist under a name it did not try.

Is DKIM enough to stop spoofing?

No. DKIM proves real mail is yours, but receivers only refuse fakes when DMARC tells them to. Use the DMARC checker on the same domains.

warnwell

Warnwell / Checks

DKIM checker that finds the selector for you

Most DKIM lookups ask for a selector you do not know. Warnwell reads the MX and SPF records, works out your email provider, and tries its selector names first.

Free
No sign-up
Up to 50 domains at once

How the selector is found

A DKIM public key sits at selector._domainkey.yourdomain.com. The selector is a name the sender picks, and it is only written in the headers of mail you send. So a lookup from the outside has to guess.

Warnwell first asks for _domainkey.yourdomain.com itself. If DNS says that name does not exist (NXDOMAIN), there are no DKIM keys anywhere under it, and the answer is final.
Then it tries the selector of the provider it sees in your MX and SPF records: google for Google Workspace, selector1 and selector2 for Microsoft 365, fm1 to fm3 for Fastmail, protonmail for Proton, and so on.
Then about 20 other common names, such as k1, s1, s2 and default.

A domain that sends no mail is skipped, as it needs no DKIM.

The three answers

Warnwell says	Meaning
Mail is signed (DKIM)	A key was found. The names are listed under "DKIM".
Your mail isn't signed (no DKIM)	No keys exist under _domainkey at all. Turn on DKIM at your email provider.
Your mail may not be signed	Your provider's usual selector has no key, and neither do the common ones. Check at the provider. A custom selector would not show here.

Gmail and Yahoo have required DKIM from bulk senders since February 2024. DKIM is also what keeps DMARC passing when mail is forwarded, since SPF breaks on forwarding.

Questions

How do I find my DKIM selector?: Open an email you sent in Gmail, choose "Show original", and look for the DKIM-Signature header. The value after s= is the selector, and d= is the domain that signed it.
Can Warnwell check a selector I name?: Not yet. It tries your provider's names and about 20 common ones. If you use Amazon SES or another sender with its own selector names, the result says the key may exist under a name it did not try.
Is DKIM enough to stop spoofing?: No. DKIM proves real mail is yours, but receivers only refuse fakes when DMARC tells them to. Use the DMARC checker on the same domains.

Updated 20 Oct 2026.