How to find a DKIM selector in an email's headers

Every mail app can show a message's raw headers. In Gmail, open the message, pick Show original from the three dot menu, and search for DKIM-Signature. In classic Outlook for Windows, open the message, go to File, then Properties, and read the Internet headers box. Apple Mail shows them under View, then Message, then All Headers.

In the DKIM-Signature header, look for a pair like d=example.com and s=selector1. The d= tag is the signing domain and s= is the selector, so that key is at selector1._domainkey.example.com. A message can carry more than one signature, often one for your domain and one for the service that sent it, so check the d= tag of each. Gmail's Authentication-Results header repeats the selector as header.s=.

Some services use the same selector names for every customer. Google Workspace suggests google, Microsoft 365 uses selector1 and selector2, and SendGrid uses s1 and s2. Others make up a selector per domain, and the only places to find it are a message header and the service's setup page.

Once you have it, enter the selector in the DNS Lookup. It reads the key, tells you whether it's RSA or Ed25519 and how long an RSA key is, and flags a key that's been revoked.