DKIM Selector Discovery

This check is informational and does not affect your score. It probes a list of common DKIM selectors plus selectors inferred from your MX and SPF records, then reports what it found. The scored DKIM check (DKIM Key Validation) lives separately and uses the same probe data; this page exists so you can see the raw discovery results without the scoring layer.

This check only runs when your domain has a non-null MX. If you have only a null MX or no MX, it shows as not applicable rather than failing.

How the verdict maps to evidence

• Pass: at least one common selector returned a v=DKIM1 record. The evidence lists which selectors and the records found.
• Unknown (no score impact): no records found at any sampled selector. Common reasons are DKIM is not configured, DKIM uses a custom selector the scanner does not probe, or the records sit at a subdomain envelope (mail.yourdomain.tld) rather than the apex.

Using the discovery results

The selectors_found field tells you which selectors RedScore was able to enumerate. Two ways to use it:

• Sanity check coverage. If you expect to see google._domainkey but only see selector1._domainkey, you may have switched providers and forgotten to update DNS, or you may have an active sender that signs with a selector not in the discovery list.
• Spot orphaned providers. A selector for a service you no longer use (an old transactional sender, an old mailbox provider) is a signal to delete that DKIM record from DNS.

If discovery returned nothing, follow the DKIM Key Validation guide to verify your real selector by checking a sent message's DKIM-Signature: header.

Verify by hand

• Send a test message from each sender to a Gmail address. "Show original" reveals the actual selector your sender uses (s=) and signing domain (d=).
• For each known selector: dig +short TXT <selector>._domainkey.yourdomain.tld @1.1.1.1.
• Cross-reference your sender list against discovered selectors and against any selectors that show up in DMARC aggregate reports.

For the actionable DKIM check (passing, failing, revoked keys, setup steps per provider), see the DKIM Key Validation guide.