The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Back to feedPost
"No DKIM record found": usually the checker asked for the wrong selector. How to find the right one in an email header.
A DKIM key has no fixed address. It lives at selector._domainkey.[your domain], and the selector is chosen by whoever signs your mail. DNS has no query that lists every name under a domain, so a checker can only try common ones (google, selector1, s1, k1...).
A real example, from a run of my email-auth-checker today:
• Amazon SES's own domain, common selectors only: no DKIM key found among 33.
• Same domain, with the selector copied from a real Amazon SES email: 1 active key.
SES uses random 32-character selectors, so no list of common names will ever find them. Gmail had already marked that email dkim=pass.
How to find your selector
Step 1: Send yourself an email from the tool you're checking. In Gmail: ⋮ > Show original.
Step 2: Find the DKIM-Signature header. d= is the signing domain, s= is the selector.
Step 3: Look up s._domainkey.d (often a CNAME pointing to your provider's key).
Right selector and still not found?
• Doubled name: you typed the full s1._domainkey.[your domain] in a DNS panel that adds the domain itself, so the record name ends with your domain twice.
• Partial set: Microsoft 365 asks for two CNAMEs (selector1 and selector2), Amazon SES for three.
• Wrong domain: if d= is your provider's domain, DKIM can pass while DMARC fails, because DMARC needs d= to match your From domain.
• Too early: resolvers can keep an earlier "not found" answer cached for a while, so check again later.
Have you checked the s= in a real header, or only the record your DNS panel shows?
The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Related posts
SPF "too many DNS lookups" (PermError): how to count them, and why it only breaks for some of your senders.
RFC 7208 sets the limit at 10. What counts:
• include, a, mx, ptr, exists and redirect: 1 lookup each, including the ones nested inside your providers' includes.
• ip4, ip6 and all: free.
Go past 10 and the receiver must return permerror.
Why it's easy to miss
The record is still valid syntax, so a checker that only reads your top-level record says it's fine. And mechanisms are evaluated left to right, stopping at the first match: a server matched early passes before an 11th lookup is ever needed. The one that fails is usually the provider listed last, often the one you just added.
A real example, from a run of my email-auth-checker this morning: github.com uses exactly 10 of 10. Eight includes on the record itself, one more inside SendGrid's include, one exists inside Salesforce's. One more lookup anywhere in that tree and the last senders stop passing SPF.
How to get back under 10
• Remove includes for tools you no longer send from. An include pointing to a domain with no SPF record is a permanent error for every message.
• Move senders that don't need your root domain to a subdomain (news.yourdomain.com), with its own SPF record and its own 10 lookups.
• Replace an include with the provider's ip4/ip6 ranges only if they publish fixed ranges, and recheck them, because they change.
• Recount after every new tool. Nested records belong to your providers and change without you touching anything.
How many includes are on your SPF record, and are you still sending from all of them?
Friday Question: When Did You Last Check Your Website on Your Phone? 📱
Not on your laptop.
Not in the editor preview.
On your actual phone. The way your customers see it.
This week I did exactly that with my own website. And I didn’t love what I saw.
The menu button was plain. The dropdown felt like an afterthought. And the most important button, “Let’s Talk,” was just another line of text in a list.
So I rebuilt it.
✔ A clearer menu button
✔ A proper slide-out menu
✔ A call-to-action you can’t miss
Nothing was “broken.” It just wasn’t helping anyone take the next step.
Here’s a 60-second test you can do right now:
→ Open your website on your phone
→ Tap the menu
→ Try to contact yourself
How many taps did it take? Did anything feel awkward?
Friday question: when did you last check your website on your phone? And what did you notice? 👇
Prime Rishty Waly – Smart Search & Verified Profile Cards
Problem: A matrimonial site with hundreds of profiles is useless if families can’t narrow them down quickly.
What I did: I built a search panel with filters for country, state, city, gender, religion, sect, caste, education, profession, status and age range, plus a search by Profile ID. I also designed the profile cards. Each one shows a Verified badge, key details like age, height, location and education, and View Profile, Message and Like buttons. Profile photos can stay blurred to protect privacy.
Tools: WordPress, Elementor, custom CSS, JavaScript, PHP.
Role: Nisbah Iqbal, Web Developer.
I love this very much