DMARC Analyzer - DKIM Selector

This article contains information on DKIM selectors, their role in email authentication, methods to identify them via email headers or DMARC Analyzer, and their importance in validating DKIM records for secure email delivery.

DKIM (Domain Keys Identified Mail) is an email authentication technique that allows the receiver to check that an email was indeed sent and authorized by the owner of that domain. A DKIM selector is part of the DKIM record and it allows the publishing of multiple DKIM keys on domains. Once the selector and the associated domain are in place, they will need to be validated. The DKIM record check of DMARC Analyzer shows if there is a valid or invalid DKIM key record. To perform DKIM record checks, the DKIM selector is needed.

The DKIM selector that needs to be used depends on the source DKIM has to be set up for. Most of the time, the source for which DKIM has to be set up, mentions the selector in their documentation. For some sources, it is possible to pick a custom selector, but this depends on the options the specific sender has. Furthermore, other senders may require an organization to publish multiple selectors on their domains, for instance, to support automated DKIM key rotation through CNAME records.

Finding a DKIM selector for an existing DKIM supported mail flow

It is possible to find out what DKIM selector a certain source uses by sending yourself an email via that source. The steps below show how to find a DKIM selector via sending yourself an email. 

1. Send an email to yourself via the source that you want to know the DKIM selector of. 
2. When you open the email, select the option to Show original.
   
   

   
   
   

3. Search for ‘DKIM-Signature’ to find the DKIM signature applied to the message. This DKIM-Signature contains an attribute ‘s=’ which is the selector used. In the example below we can see the DKIM selector is ‘google’. 

How to find the DKIM selector via the DMARC Analyzer Suite? 

Within DMARC Analyzer it is possible to see the DKIM selector a source uses. The steps below describe the easiest way to find the DKIM selector within the DMARC Analyzer Suite.

1. Log in to DMARC Analyzer.
2. Navigate to DMARC aggregate reports | Per host.
3. This overview shows all sources sending email on behalf of a certain domain or domains. 

4. Select the desired source and expand the rows.
5. The DKIM selector is displayed in the DKIM verification column.