How do I find the DKIM selector for my domain in Dmarcian or Hubspot?
Matthew Whittaker
Co-founder & CTO, Suped
Published 18 Apr 2025
Updated 17 Aug 2025
8 min read
Finding your DKIM selector is a critical step in setting up robust email authentication for your domain. Without the correct selector, your emails may fail DKIM authentication, leading to deliverability issues and potentially landing in spam folders. This can be especially frustrating when using platforms like HubSpot, where the setup process might seem straightforward but requires this specific piece of information. Similarly, if you're using a DMARC reporting tool like Dmarcian to check your domain's authentication status, you'll quickly discover that a selector is often needed for a comprehensive check.
The challenge arises because DKIM selectors aren't always immediately obvious. They are essentially a unique identifier that tells receiving mail servers which public key to use when verifying your email's DKIM signature. Different email service providers (ESPs) and internal mail servers use various naming conventions for their selectors, and DMARC tools, while powerful, cannot possibly guess every single one. This is why understanding where to find your selector, especially from your email sending platform, is so important for ensuring your emails are properly authenticated and delivered.
In this guide, I'll walk you through the process of locating your DKIM selector, focusing specifically on how it's typically found within HubSpot and how you can use that information with Dmarcian or other validation tools. We'll also explore alternative methods for discovering a selector if you're having trouble finding it directly in your platform settings.
HubSpot handles DKIM authentication by providing CNAME records that you add to your DNS. These CNAMEs typically include the DKIM selector as part of the subdomain. When you set up email sending domains in HubSpot, the system generates these specific records for you. It's important to copy these values precisely into your domain's DNS settings.
To find your DKIM selector in HubSpot, log in to your HubSpot account. Navigate to Settings (the gear icon), then in the left sidebar menu, look for Content > Domains & URLs. Scroll down to the Email sending domains section. Each email sending domain you have connected will be listed, along with its authentication status and the necessary DNS records. The CNAME record provided will typically look something like XXXXXXXX.dkim.hubspotemail.net, where XXXXXXXX is your selector. If you're trying to set up DKIM for a specific custom domain, you might also find guidance on how to sign DKIM on a sender domain that isn't your primary one.
The selector is the part that precedes ._domainkey in the full DKIM record name. For instance, if your DKIM record is named hs1a._domainkey.yourdomain.com, then hs1a is your selector. HubSpot usually provides a very clear label for this, so you shouldn't have to guess. Keeping track of how DKIM selectors affect email reputation is also good practice.
After finding this information in HubSpot, you'll use it to update your DNS records. Once updated, it can take some time for DNS changes to propagate globally. You can then use tools to verify the setup.
Using Dmarcian and understanding its limitations
While Dmarcian is excellent for DMARC reporting and analyzing your email authentication, its general domain checker isn't designed to automatically discover every possible DKIM selector for a domain. This is due to the nature of DKIM, where selectors can be arbitrary strings, making it impossible for a tool to scan for all of them without prior knowledge.
When you use Dmarcian's DMARC Domain Checker, it will typically prompt you to enter the DKIM selector manually if it can't find a common one. This is where the information you obtained from HubSpot (or your ESP) becomes crucial. You'll input that specific selector into the tool to allow it to query the correct DNS record and verify your DKIM setup. If you're encountering issues, understanding how to fix DKIM errors can be helpful.
Dmarcian, like many other DMARC tools, focuses on aggregating and analyzing DMARC reports, which contain information about SPF and DKIM authentication outcomes. These reports (often XML files) will specify which selectors were used for signing emails that passed or failed authentication. By regularly reviewing these DMARC reports, you can gain insights into how your DKIM records are performing in the wild, including which selectors are being used by various sending sources.
Alternative methods for finding a selector
What if you can't find the selector in HubSpot, or you need to verify it for a sender not managed by an ESP? One common method is to inspect the email headers of a message sent from the domain in question. When an email is sent with a DKIM signature, the selector used is embedded within the DKIM-Signature header field. Look for the s= tag, as its value is your selector.
In the example above, selector1 is the DKIM selector. You can view email headers in most email clients (e.g., Gmail, Outlook) by looking for an option like Show original or View source. If you're having trouble locating a DKIM record without a selector, there are also methods for that scenario.
Another strategy involves using online DKIM lookup tools. Some tools are designed to scan for common selectors. While these tools might not find every selector, they can often discover standard ones used by major ESPs. This can be a good starting point if you're completely in the dark about your selector. Always verify any discovered selector by testing it with your domain's DKIM record.
Remember that the DKIM record is essentially used to verify that you are the owner of the domain that is used in the "from/reply-to" email addresses. If you're managing multiple email services, like HubSpot, SendGrid, and ActiveCampaign, you might need multiple DKIM records each with its own selector.
Ensuring proper DKIM authentication
Importance of accurate DKIM selectors
An incorrect or missing DKIM selector means your emails cannot be properly authenticated. This directly impacts your email deliverability, increasing the chances of your emails being marked as spam or rejected outright by receiving mail servers. It's a fundamental part of establishing trust in your sending domain.
Troubleshooting common issues
Double-check: Ensure you've copied the exact selector provided by HubSpot. Any typo will lead to a lookup failure.
Propagation time: DNS changes can take hours, sometimes up to 48 hours, to propagate across the internet. Be patient before re-checking.
DNS provider specifics: Some DNS providers automatically append your domain name to the host record. If your selector is hs1a._domainkey, you might only need to enter hs1a._domainkey without your full domain.
Ensuring your DKIM records are correctly published with the right selector is fundamental to email deliverability and protecting your domain's reputation. Incorrect configurations can lead to your legitimate emails being flagged as spam, affecting your marketing campaigns and transactional emails. This is also where DMARC monitoring comes into play, providing comprehensive insights into authentication failures.
Regularly checking your authentication status, even after initial setup, is a wise practice. Tools like Dmarcian (when provided with the correct selector) and other general email deliverability testers can help you stay on top of any potential issues before they severely impact your email program. Also, be aware of how SPF alignment works with DMARC in HubSpot to ensure complete email authentication.
Conclusion
Finding your DKIM selector is a fundamental step toward achieving excellent email deliverability and DMARC compliance. For HubSpot users, the process is straightforward, requiring a simple navigation to your email sending domain settings to retrieve the CNAME records. Once you have that selector, tools like Dmarcian can then provide accurate validation of your DKIM setup.
Remember, the key is knowing where your ESP (like HubSpot) provides this information, and understanding that general domain checkers might need your input to perform a comprehensive DKIM lookup. Regularly checking your email authentication, including your DKIM records and selectors, is a proactive measure that prevents your emails from being mistakenly identified as spam, ensuring your messages reach their intended recipients.
Views from the trenches
Best practices
Always retrieve the DKIM selector directly from your email service provider's (ESP) settings or documentation to ensure accuracy.
Regularly inspect the headers of emails sent from your domain to confirm that the expected DKIM selector is present and correctly signing your messages.
Use a DMARC monitoring service to receive aggregated reports that detail your DKIM authentication results, including selector usage.
Be aware that different sending platforms may utilize unique DKIM selectors, necessitating separate record management for each.
Verify that your DNS provider has correctly published the DKIM CNAME record and allowed sufficient time for global propagation.
Common pitfalls
Assuming that a general domain checker will automatically find your specific DKIM selector without needing manual input.
Mistyping the DKIM selector when adding it to your DNS records, leading to authentication failures.
Forgetting about DNS propagation delays, and prematurely concluding that the DKIM record setup has failed.
Not accounting for multiple ESPs, each potentially requiring a distinct DKIM selector and record for proper authentication.
Overlooking the importance of aligning the DKIM signing domain with your 'From' header domain for DMARC compliance.
Expert tips
When troubleshooting, prioritize checking your ESP's authentication page for the exact DKIM record and selector.
Leverage the 'Show Original' or 'View Source' feature in email clients to quickly extract the 's=' value from DKIM signatures.
For complex setups or if direct selectors aren't available, consider using a specialized DKIM lookup tool that probes common selector names.
Implement a DMARC policy with reporting enabled early on to gain visibility into all DKIM authentication outcomes for your domain.
Always back up your DNS configurations before making changes to DKIM or other email authentication records.
Expert view
Expert from Email Geeks says Dmarcian cannot automatically detect all possible DKIM selectors due to their vast number.
2024-01-29 - Email Geeks
Expert view
Expert from Email Geeks says many DKIM validation tools require users to either send a test email or manually input the selector for accurate verification.
