hostnag

Is this DKIM selector publishing a key?

Name a mail domain and the selector your sender signs with to see whether the public key it needs is published. It runs once with a 10 second cap, the same runner a monitor uses; the result says where it ran.

Up to three, comma-separated. The selector is the s= value in a signed message's DKIM-Signature header.

How to read this

DKIM
One row per selector: a key published, a record present with an empty key (the selector was revoked), or no record at all.
MX, SPF and DMARC
The rest of the mail setup is read on the same run. Blocklists are left to their own page.

Questions

Where do I find my selector?

Open a message your system sent and read the s= tag in its DKIM-Signature header. Google Workspace signs with google by default, Microsoft 365 with selector1 and selector2.

Is this a scan?

No. It reads one TXT record per selector you name, at <selector>._domainkey.<domain>, and nothing else.

Related

Mail health monitoringThe records that keep mail deliverable, plus up to 8 sending addresses checked against the blocklists that actually get you rejected.

Read

SPF, DKIM and DMARC explained: how to read the records and the mistakes that get mail rejectedWhat SPF, DKIM and DMARC each do, how to read a record term by term, the dig commands, and the mistakes that get legitimate mail rejected.

Watch this for good.

Start free