What Is DKIM selector?

How a receiver finds the key

A DKIM signature includes a selector and a signing domain. Together they identify the public-key lookup location, conventionally written as the selector followed by the DKIM domain-key label and the signing domain. The selector lets a domain support different keys or signing systems without placing every public key at one shared lookup name. It is a reference in the signature, not the secret used to create it.

The signing service retains the private key. DNS publishes the public information a receiver uses for verification, either directly or through a provider's supported delegation arrangement. A provider may request TXT or CNAME configuration. Follow that provider's exact record instructions instead of substituting one record type because another service used it previously.

Selectors support controlled key changes

Separate selectors can help a domain operate more than one signing service or transition between keys. A key change still needs coordination: identify the active signing configuration, publish the required public record and check actual signed messages. Removing a record while relevant messages remain in transit can affect verification. The safe overlap and retirement process depends on the sending system and message flow.

What the selector does not prove

A selector name does not establish DKIM validity, key strength, authorization to send or DMARC alignment. Alignment uses the authenticated signing domain and author domain, not whether the selector contains the company name. Inspect the signature and receiver result together when diagnosing a failure. Keep a simple inventory linking each selector to its service, record owner and change history. A forgotten selector should prompt investigation rather than an automatic deletion or an assumption that the entire domain is compromised. Treat the reference, the key and the authenticated identity as separate pieces of evidence.