DKIM selector not found — how to locate your actual selector
There is no DNS record that lists a domain's DKIM selectors. Every external checker, this one included, works by guessing the selectors that well-known providers use — selector1 for Microsoft 365, google for Google Workspace, and so on.
A "not found" result therefore means "none of the selectors we tried answered", not "you have no DKIM". Providers such as HubSpot and Amazon SES use unguessable per-account tokens that no scanner can discover.
The reliable way to find your real selector is to read it off a message you actually sent.
How to fix it
- 1Send yourself a message from the system in question and open the raw source or original message.
- 2Find the DKIM-Signature header and read the s= tag — that is your selector, and the d= tag is the signing domain.
- 3Confirm the key resolves: the record lives at <selector>._domainkey.<signing-domain>.
- 4Pin the selector on the domain in Mailward so future checks target it directly.
- 5If d= is your provider's domain rather than yours, DKIM will not align for DMARC — configure branded/custom DKIM with that vendor.
Check whether your domain has this problem
Free, no signup, about two seconds. You get the exact record to paste.
Related guides
- DKIM record with empty p= — a revoked key still in use
- SPF include points at a domain with no SPF record — a silent PermError
- DMARC record syntax errors that make receivers skip your policy
- DMARC external destination not authorized — why you receive no reports
- Two DMARC records at _dmarc — why your policy is being ignored