Bulk DKIM Selector Finder: Discover DKIM Keys & Providers

Find out which DKIM selectors a domain publishes, for one domain or ten thousand. The actor tests 145 well-known selector names (or ~355 with the extended list) under <selector>._domainkey.<domain>, follows CNAMEs, and for every key it finds reports the sending provider, the CNAME target, the key type and RSA size, whether the key is revoked or in test mode, and any problems: weak 1024-bit or sub-1024-bit keys, dangling CNAMEs, malformed records, duplicate TXT records, SHA-1-only hash tags.

Use it to:

• Inventory every service that sends mail as your domains (Microsoft 365, Google Workspace, SendGrid, Mailchimp, HubSpot, Zendesk...), including old ones nobody remembers setting up.
• Find weak keys to rotate: 1024-bit RSA keys are still everywhere (even on very large domains).
• Clean up DNS: dangling CNAMEs, revoked keys and records that are not DKIM at all.
• Research sending stacks for a list of companies (sales, M&A due diligence, MSP onboarding).

Why this one

• Its whole job is selector discovery. Email-audit bundles usually test a handful of selectors as a side check. This actor tests 145+ names with provider hints, optional date-based patterns, and your own names.
• Provider from the CNAME target, not just the name. s1 can be SendGrid, Atlassian or Freshworks, and k1 can be Mailchimp or Mailgun. When the record is a CNAME, the target zone (for example sendgrid.net, mcsv.net, onmicrosoft.com, dkim.amazonses.com) decides.
• Real key parsing. The p= value is decoded as a DER public key, so the RSA size is exact (SubjectPublicKeyInfo, with PKCS#1 accepted). Ed25519 keys (RFC 8463) are recognised too.
• Honest DNS answers. NXDOMAIN, "name exists but no TXT", and SERVFAIL/timeouts are counted separately. Failed lookups are retried, then sent to a second public resolver, and anything still unknown is listed rather than reported as "not found".
• Wildcard-aware. A random selector is probed first. If *._domainkey answers everything, matching answers are hidden instead of being reported as 145 fake selectors. Parked domains that publish a wildcard empty key (v=DKIM1; p=) are recognised.
• Bulk-friendly input. Paste domains, email addresses or URLs. You can also paste selector._domainkey.example.com names, or a whole DKIM-Signature header (the d= and s= tags are used).

Input

{
  "domains": ["example.com", "jane@example.org", "https://www.example.net/contact", "s1._domainkey.example.io"],
  "extraSelectors": ["hs1-1234567", "mycustom2024"],
  "selectorSet": "common",
  "dateSelectors": false,
  "includeRecordText": false
}

Field	Default	Notes
domains	required	Domains, emails, URLs, selector._domainkey.domain names or DKIM-Signature headers. One per line, or comma/space separated; # starts a comment. IDNs are converted. Duplicates are removed and invalid entries are listed in SUMMARY. Up to 10,000 per run.
extraSelectors	–	Your own selector names, tried first on every domain
selectorSet	common	common (145 names) or extended (~355: adds SparkPost scphMMYY 2015–2025, Salesforce Marketing Cloud 10dkim1–51dkim1, years and rarer generic names)
dateSelectors	false	Adds YYYYMM, sYYYYMM, YYYYMM01 and scphMMYY for the last 24 months (about 96 extra lookups per domain)
includeRecordText	false	Adds the raw TXT record to each selector row
outputRows	all	all, selectors (only keys found) or domains (only one summary row per domain)
concurrency	25	DNS lookups in flight (max 100)
dnsResolver	cloudflare	cloudflare or google DNS-over-HTTPS; the other one is the fallback
timeoutSecs	5	Per DNS request

Output

The dataset has one summary row per domain (rowType: "domain") followed by one row per selector found (rowType: "selector"). The two views are Overview and Selector details.

Domain row:

{
  "rowType": "domain",
  "domain": "example.com",
  "status": "WARN",
  "selectorsFound": 4,
  "selector": "selector1, selector2, google, s1",
  "provider": "Microsoft 365, Google Workspace, SendGrid",
  "keyBits": 1024,
  "weakestKey": { "selector": "google", "keyBits": 1024 },
  "strongestKeyBits": 2048,
  "revokedSelectors": [],
  "issues": [
    "WARN: selector1: CNAME target selector1-example-com._domainkey.example.onmicrosoft.com does not exist (NXDOMAIN, dangling CNAME)...",
    "WARN: google: RSA key is 1024 bits; 2048 bits is the current recommendation"
  ],
  "selectorsTested": 145,
  "nxdomain": 139,
  "noData": 2,
  "lookupErrors": 0,
  "domainkeyNode": "NOERROR",
  "wildcardDkim": false,
  "note": null
}

Selector row:

{
  "rowType": "selector",
  "domain": "example.com",
  "selector": "s1",
  "fqdn": "s1._domainkey.example.com",
  "status": "OK",
  "recordType": "CNAME → TXT",
  "cnameTarget": "s1.domainkey.u1234567.wl123.sendgrid.net",
  "provider": "SendGrid",
  "providerSource": "cname-target",
  "v": "DKIM1",
  "keyType": "rsa",
  "keyBits": 2048,
  "revoked": false,
  "testing": false,
  "hashAlgorithms": null,
  "serviceTypes": null,
  "flags": "s",
  "keySha256": "q0u6...=",
  "ttl": 3600,
  "issues": ["INFO: t=s: i= must match d= exactly (no subdomains)"]
}

Domain status: OK (keys found, no warnings), WARN, CRITICAL, NONE_FOUND (no tested name exists), INCOMPLETE (none found, but some lookups failed), ERROR (every lookup failed), DOMAIN_NOT_FOUND (the domain itself is NXDOMAIN). Selector status: OK, WARN, CRITICAL, or REVOKED (empty p=).

Issue rules:

• CRITICAL: RSA key under 1024 bits, undecodable or missing p=, v= other than DKIM1.
• WARN: 1024-bit RSA, RSA over 4096 bits, dangling CNAME (target is NXDOMAIN), CNAME target without TXT, more than one DKIM record at a selector, h= without sha256, s= that excludes email, a TXT that is not a DKIM record, every selector found is revoked or broken.
• INFO: revoked key, test mode (t=y), t=s, Ed25519 key (pair it with RSA), PKCS#1 key encoding, several selectors sharing one public key.

The key-value store record SUMMARY has status counts, provider counts across all domains, the most common selectors, the weakest keys, domains with no selector found, invalid inputs and DNS statistics.

Providers recognised

Provider	Selectors tried	Recognised CNAME target
Microsoft 365	selector1, selector2	*.onmicrosoft.com, *.dkim.mail.microsoft
Google Workspace / Gmail	google, 20161025, 20210112, 20221208, 20230601	– (TXT)
Mailchimp / Mandrill	k1, k2, k3, mandrill, mte1, mte2	mcsv.net, mandrillapp.com
SendGrid	s1, s2, smtpapi, sendgrid	sendgrid.net
Mailgun	mx, k1, krs, pic, smtp, mailo, pdk1, pdk2, mg	mailgun.org
Amazon SES	(hashed names, see limits)	dkim.amazonses.com
Zoho Mail	zoho, zmail, zohomail	zoho.*
Salesforce / Marketing Cloud / Pardot	sf1, sf2, sf, 200608, pardot (+ 10dkim1–51dkim1 extended)	custdkim.salesforce.com, exacttarget.com
HubSpot	hs1, hs2, hubspot	hubspotemail.net
Postmark	pm	mtasv.net
SparkPost (Bird)	scph (+ scphMMYY extended / date)	sparkpostmail.com
Klaviyo	kl, kl1, kl2, km1–km4, kt1, kt2, ks1, ks2	klaviyo.com
Yahoo / AOL	s1024, s2048	–
Fastmail	fm1, fm2, fm3, mesmtp	fmhosted.com
Proton Mail	protonmail, protonmail2, protonmail3	proton.ch
Zendesk, Freshdesk, Help Scout, Intercom, Gorgias	zendesk1–3, fd, fd2, fdm, strong1, strong2, intercom, gor, gor2	zendesk.com, freshpo.com, helpscout.net, intercom-mail.com
Constant Contact, Brevo, Mailjet, MailerLite/MailerSend, ActiveCampaign, Campaign Monitor, Kit, AWeber, Marketo, Everlytic, Emma, Sailthru, Resend, Elastic Email	ctct1, ctct2, mail, brevo1, brevo2, mailjet, litesrv, ml, ms1, ms2, mlsend2, acdkim1, acdkim2, dk, cm, cka, aweber_key_a–c, m1, m2, everlytickey1, everlytickey2, e2ma-k1–k3, slt, resend, api	constantcontact.com, sendinblue.com, mailjet.com, mlsend.com, acems*.com, aweber.com
Mimecast, Proofpoint, Cisco, Hornetsecurity	mimecast, mc1–mc3, pphosted, ces1, ces2, hse1, hse2	mimecast.com, pphosted.com, hornetsecurity.com
Mailbox hosts	sig1 (iCloud+), secureserver1/2 (GoDaddy), privateemail (Namecheap), s1-ionos, s2-ionos, hostingermail-a/b/c, x (MXroute/DirectAdmin), default (cPanel/Plesk)	icloudmailadmin.com, secureserver.net
Generic	dkim, dkim1, dkim2, mail, email, smtp, key1, key2, s3, rsa, ...	–

Many names are shared between services, so a hint from the name alone is shown with providerSource: "selector-name", and a CNAME match with providerSource: "cname-target".

Limits (please read)

• DKIM selectors cannot be enumerated. DNS has no way to list the names under _domainkey, so any selector finder can only test names it knows. NONE_FOUND means none of the tested names exist, not that the domain has no DKIM. To test the exact selector, take the s= tag from a DKIM-Signature header of a real message and put it in extraSelectors (or paste the header into domains).
• Amazon SES Easy DKIM uses three random 32-character selectors, and HubSpot adds an account number (hs1-1234567). Postmark's dated selectors (20240115103045pm), Mimecast's dated ones and other custom or per-account names can't be guessed. They are only found when you supply them in extraSelectors.
• domainkeyNode is the DNS answer for _domainkey.<domain> itself. NXDOMAIN there suggests nothing exists below it (RFC 8020), but some DNS servers don't follow that rule, so it is shown as a hint and not used to skip lookups.
• Lookups go through public DNS-over-HTTPS resolvers (Cloudflare, Google), so results reflect public DNS. Internal or split-horizon zones are not visible.
• Only DNS is queried. No mail is sent and no servers are contacted beyond the resolvers.

Pricing

Pay per event: $2 per 1,000 domains ($0.002 per domain checked, whatever the selector list size). Invalid and duplicate inputs aren't charged.

FAQ

Why does a domain show "none found" when its mail passes DKIM? Its active selector is a name that isn't in the list (common with Amazon SES, HubSpot and self-hosted signers). Look at a received message's DKIM-Signature header, find s=, and add that name to extraSelectors.

Microsoft 365 shows a dangling selector1 or selector2 CNAME. Is that broken? Not necessarily. Microsoft 365 publishes two selectors and often only the active one has a key behind it. It becomes a problem only if that selector is the one signing, or if DKIM is turned off and the records are leftovers.

Is a 1024-bit key a problem? 1024-bit RSA still verifies everywhere, but 2048 bits is the current recommendation (Microsoft 365, Google Workspace and most ESPs support it). Keys under 1024 bits are ignored by receivers (RFC 8301), so they are rated CRITICAL.

What does REVOKED mean? The record has an empty p=, which is how a retired key is withdrawn. It is normal after a rotation. If every selector found is revoked, the active one simply wasn't tested.

Can I schedule it? Yes. Save your domain list as a task and add a schedule, for example monthly, to catch new senders and weak keys.

Related

• Bulk SPF / DMARC / MX Auditor: SPF, DMARC and MX checks for many domains.
• Microsoft 365 Tenant Finder: tenant ID and identity provider for company domains.
• Bulk SSL Certificate Expiry Monitor: certificate expiry on any port, including STARTTLS mail servers.