PayFlowFix.dev
guide · dkim selector not found

Finding your DKIM selector

DNS gives no way to list which DKIM selectors exist on a domain, so "not found" never means "not there". Here is how to find your real selector from a message header or your provider.

What this actually means

This is the common pattern we see when dkim selector not found comes up in search.

Run the free checker on your domain to see your own numbers. The checker shows the full SPF include chain, the exact lookup count, and which selector actually exists for DKIM.

Why it matters for payment flows

Customers who pay successfully but never get a receipt, invoice or status update assume the payment failed. Support tickets follow, refunds are requested, and the engineering team spends hours debugging a webhook that never had a chance to be read.

What to do next

  1. Check the domain with the free tool.
  2. Fix the mechanical issue first — lookup limit, missing DKIM, absent DMARC. Those are checkable in under a minute.
  3. If email authentication is clean and the customer still sees nothing, the fault is downstream: a webhook that failed signature verification, an event type you never subscribed to, or a status that never synced.

Sources and standards

  • RFC 7208 SPF, RFC 7489 DMARC, RFC 6376 DKIM — the actual specifications, not a blog summary.
  • Lookup counts measured live with the engine in this repo, https://payflowfix.dev.

FAQ

DKIM selector not found: how to find yours
DNS gives no way to list which DKIM selectors exist on a domain, so "not found" never means "not there". Here is how to find your real selector from a message header or your provider.
Where does this fit in a payment flow?
Email authentication is upstream of whether a customer ever sees a receipt. If SPF, DKIM or DMARC is broken, the receipt, invoice or password reset lands in spam or is rejected. That looks like a payment integration failure, but it is DNS.
Can I check this myself?
Yes — the free checker expands your whole SPF chain and counts lookups the way a receiver does. Paste your domain and you get a copy-ready record.
Do you log my domain?
No. The checker runs in your browser against Cloudflare and Google DNS-over-HTTPS. This site is static; there is no backend.

Still broken after the DNS is right?

Email authentication is DNS. Payment notifications not arriving is usually not — it is a webhook that failed signature verification, an event type you never subscribed to, or a status that never synced. That is what I fix: a fixed-fee $99 root-cause diagnosis, credited toward the repair.

Get a $99 diagnosis What I fix