9

Is there any way to find out what selectors are used by a domain in their DKIM record without access to an e-mail send from that domain?

So to clarify, let's say I know example.com has DKIM implemented. I cannot receive an e-mail from example.com as I know no one that works there. Can I still check the existence and validity of the DKIM record even though I do not know the name of the used selector? (or find the selector somehow without e-mail).

3 Answers 3

11

There is no way to detect if DKIM is implemented by the sender without getting a mail from the sender, extracting the selector from the DKIM-Signature header and getting the DKIM policy from DNS based on this selector.

One can check if some commonly used selectors can be found in DNS. But a successful check does not mean that any of these selector actually gets used for signing nor does it mean that the messages gets signed at all. And, no typical selector found does not mean that DKIM is not implemented.

0
4

There are some commonly used selectors that you can try, and in fact could build your own table of possibilities to pass into a program or script to check against.

I recommend trying:

google
dkim
mail
default

For example: dig -t TXT +short google._domainkey.domain.com

It should go without saying that if you have the DKIM and no email to compare it against, obviously it's not really of any use. But if all you're interested in is identifying if it's configured, and what the public key might be, go with trying common selectors.

1
  • "This not entirely accure, the answer by Steffen" - I think what you write in your answer is just an extended but not actually contradicting version of what I already said with "One can check if some commonly used selectors can be found in DNS.". Note though that I also said "But a successful check does not mean that any of these selector actually gets used for signing" - a point which you are missing. Jul 2, 2022 at 6:31
1

You can use registry.prove.email to get the DKIM selectors for any domain that's been contributed to the registry prior, which includes 900,000+ domain/DKIM key pairs. Selectors can be extremely diverse -- I think there are a few thousand different ones on this site, but most of the other sites I've seen just try a handful of default values. You can also manually try hitting all the selectors via DNS from a big list of selectors, such as this one on GitHub, or you can also get a big list of selectors via the registry.prove.email API.

12
  • 1
    So, a database so small that it's statistically improbable that a domain would be on it? I'm not sure that this is at all helpful.
    – schroeder
    Mar 20 at 9:37
  • Hoping that even though it may not be perfect, it can help the author with the most popular domains, and to get a sense of what common keys or selectors might be easily. Given that it's only about a month old, hopefully we see it expand! Mar 23 at 23:37
  • Oh? How does one see the selectors? That's not evident anywhere. And is this your project?
    – schroeder
    Mar 24 at 17:33
  • 1
    easydmarc.com/tools/dkim-lookup Not only do they have their own database, but they have a brute-force discovery tool. They successfully found my company's selectors (and we're tiny) and all the other domains I tried on the prove.email tool that weren't there. So, perhaps you could re-focus your answer to state that there are sector databases out there that allow for look-up of known selectors. prove.email is one. easydmarc is another, and any other database you are aware of that would be relevant
    – schroeder
    Mar 25 at 19:46
  • 1
    I also found this dictionary of dkim selectors: github.com/vavkamil/dkimsc4n/blob/master/dkim_selectors.lst used by a tool to brute-force the discovery, which is a whole other approach to this question.
    – schroeder
    Mar 25 at 19:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .