Skip to content

DKIM selectors and key rotation

A DKIM selector tells receivers where to find the key that signs your mail: <selector>._domainkey.<your domain>. Each sending service has its own.

Finding your selectors

  • Open the domain page and use Detect selectors. EmailShift tries the selectors common platforms use and shows what it finds.
  • Once DMARC reports arrive, EmailShift also suggests the selectors actually seen signing your mail.
  • Your sending platform lists the selector in its domain or authentication settings.

Key rotation (Amazon SES, Microsoft 365 and others)

Some providers publish two or three selectors but sign with only one at a time, and switch between them to rotate keys. The inactive selectors point to the provider but have no key while on standby.

EmailShift recognizes this. Selectors delegated to the same provider are checked together:

  • If at least one of them has a valid key, the others are shown as Standby (rotation), not as failures.
  • If none of them has a key, they all fail, for example when DKIM has not been switched on in Microsoft 365 yet.

Add all selectors your provider gives you, so the one currently signing is always checked.

Something unclear or missing? Tell us.