Every SMTP provider publishes DKIM keys under its own well-known selector names. SendGrid uses s1 and s2. Postmark uses dated selectors like 20240905. Microsoft 365 rotates between selector1 and selector2. Enumerate them and you get a truthful answer to a common question: who is signing mail on this domain right now?
This inventory probes every DKIM selector we have on file for the SMTP providers we cover, plus a short list of generic selectors used across the industry. The lookups run in your browser over DNS-over-HTTPS. Nothing is sent to a server we control.
DKIM Inventory
Enter a sending domain to enumerate its DKIM selectors. The tool probes the well-known selectors used by every SMTP provider we cover, plus a short list of generic selectors, and reports which providers appear to be signing mail on this domain.
What a DKIM inventory tells you
DKIM adds a cryptographic signature to every outbound message. The receiving server checks that signature against a public key published in your DNS at <selector>._domainkey.<yourdomain>. Enumerate the selectors, and you learn which providers you have configured to sign mail. Two selectors from the same provider is normal, that is the standard rotation pattern. Selectors from two different providers means both services are actively sending on your domain, whether you meant them to or not.
The results also show the key size. Anything under 1024 bits is broken by modern standards. 1024-bit keys are deprecated. 2048-bit is the current baseline. A p= tag with no value means the key has been revoked, usually left in place to expire cleanly after a rotation.
The limits of enumeration
Some providers issue a random per-tenant selector token instead of publishing a well-known name. Amazon SES Easy DKIM is the common example: it hands you three CNAMEs with 44-character random tokens for selectors. There is no dictionary attack on those. If your domain uses SES Easy DKIM and nothing else, this tool will report no DKIM found, even though the domain is signing correctly. In that case, check your SES verified identity or query the specific selector directly.
The same caveat applies to any provider that generates a unique DKIM selector per account. The inventory here is exhaustive against the standard, published selectors and blind to random tokens by design.
Next step: the full authentication scorecard
DKIM is one of three records that decide whether your mail reaches the inbox. For the SPF and DMARC picture too, and a compliance scorecard against Gmail, Yahoo, and Microsoft 365 bulk-sender requirements, run the domain through the DNS Auth Checker.