DKIM selector finder

Looks up selector._domainkey for a fixed list of selectors used by common mail providers and generic setups, and checks each key record found like the DKIM record check. Finding none is a hint, not proof that DKIM is missing.

Updated 2026-10-25

What this tool checks

A DKIM public key lives at SELECTOR._domainkey.DOMAIN, and you have to know the selector to find it. When you do not know it, this tool tries a fixed list of selectors that mail providers and mail software commonly use:

Google Workspace: google.
Microsoft 365: selector1 and selector2.
Mailchimp and Mandrill: k1, k2, k3 and mandrill.
SendGrid: s1, s2 and smtpapi.
Mailgun: mailo and mg.
Zoho: zoho and zmail.
Proton: protonmail, protonmail2 and protonmail3.
Fastmail: fm1, fm2 and fm3.
Mailjet: mailjet. Amazon SES: the older fixed name amazonses.
Generic names: default, dkim, mail, smtp and sig1.

The lookups run in parallel with a limit on how many are in flight at once. Every key that is found is checked with the same rules as the DKIM record check.

A hint, not a verdict

The result is a hint about which providers sign for the domain. Finding no key is information, never a warning or an error, because a domain can sign with selectors that are not on the list. Amazon SES Easy DKIM, for example, uses random selector names. Finding a key also does not prove that current mail is signed with it; old keys are often left in DNS.

How to read the result

The result lists the selectors that were tried and a section for each key that was found, with its key type and size. Problems with a found key appear as the usual DKIM findings, such as DKIM_WEAK_KEY or DKIM_KEY_REVOKED. The DKIM guide explains selectors and key rotation.

Limitations

Only the 27 listed selectors are tried. Selectors outside the list are never found.
Signatures in messages are not verified.
When you know the selector, the DKIM record check checks exactly that one.

Use it from code

API reference for DKIM selector finder

curl -i "https://api.probekit.dev/v1/mail/dkim-discover?domain=example.com"

A request without payment is answered with 402 Payment Required and the exact price. See the API reference.

Limits

Input	Domain
Deadline	10 seconds
Freshness	Up to 5 minutes, never longer than the record TTL
Price	$0.02 per check

Findings this tool can report

Check (1)

Warning CHECK_QUERY_BUDGET_EXCEEDED The check stopped after reaching its DNS query limit.

DKIM (7)

Error DKIM_INVALID_KEY The DKIM public key is not valid base64.
Warning DKIM_KEY_REVOKED The DKIM key for this selector is revoked (empty p tag).
Error DKIM_MULTIPLE_RECORDS More than one DKIM record was found for the selector.
Info DKIM_NO_COMMON_SELECTORS No DKIM key was found under the common selectors that were tried.
Error DKIM_SYNTAX_ERROR The DKIM record contains a tag that cannot be parsed or has an invalid value.
Info DKIM_TESTING_MODE The DKIM record is in testing mode (t=y).
Warning DKIM_WEAK_KEY The RSA key is shorter than 1024 bits.

DNS (2)

Warning DNS_RESOLVER_FAILURE The DNS resolver returned a server failure.
Warning DNS_RESOLVER_TIMEOUT The DNS resolver did not answer in time.

Frequently asked questions

Why can't the tool list all DKIM selectors of a domain?

DNS has no way to list the names under _domainkey. A key can only be found if you ask for its exact name, and the selector part of that name is chosen freely by whoever signs the mail. The tool can only try names that are commonly used.

No selectors were found. Does my domain lack DKIM?

Not necessarily. The result DKIM_NO_COMMON_SELECTORS only says that none of the names on the list has a key. Many providers use selectors with random or customer-specific names, which this tool cannot guess. Look at the s= tag in the DKIM-Signature header of a message from the domain to find the real selector.

Which selectors are tried?

A fixed list of 27: default, dkim, mail, smtp, sig1, s1, s2, k1, k2, k3, google, selector1, selector2, mandrill, smtpapi, mailo, mg, zoho, zmail, protonmail, protonmail2, protonmail3, fm1, fm2, fm3, mailjet and amazonses. The same list is used every time, so results can be compared.

What is checked for a key that is found?

The same as in the DKIM record check: the tags of the record, the key type, the RSA key size read from the key itself, a revoked key with an empty p tag, testing mode and multiple records under one selector.