DKIM selectors explained
A selector is the label that tells the receiver which public key to fetch from DNS. Different services use different selectors, and rotating them is how you change keys without downtime.
The mechanism
A label that points to the right public key.
A DKIM selector is the s= tag in the
DKIM-Signature header. It tells the receiver
which TXT record to look up: for selector
s1 and domain example.com, the
record is at s1._domainkey.example.com.
Why selectors exist
A domain may have multiple signing keys at the same time: one for the main mail server, another for a marketing platform, a third for a transactional sender. Each gets its own selector, so signatures never collide.
Common selector names
| Provider | Typical selectors |
|---|---|
| Google Workspace | google |
| Microsoft 365 | selector1, selector2 |
| Postmark | 20230601 (date-based) |
| Mailchimp / Mandrill | k1 |
| SendGrid | s1, s2 |
| Amazon SES | Three CNAME-based selectors |
Key rotation
To rotate a key: publish the new key under a new selector, update the signing configuration, wait for the old signatures to age out of delivery queues (72 hours is safe), then remove the old TXT record. Removing the old record too early invalidates signatures still in transit.
What can go wrong
Related findings.
| Finding | What it means |
|---|---|
dkim_key_not_found
|
DKIM public key not found |
dkim_weak_key
|
Weak DKIM key |
More guides
Keep reading.
How SPF works
SPF declares which servers may send mail for a domain. A TXT record in DNS lists IP addresses and includes, and a receiver evaluates them in order.
How DKIM works
DKIM attaches a cryptographic signature to each message. The receiver fetches the public key from DNS and verifies that the message was not altered after signing.
How DMARC works
DMARC ties SPF and DKIM together by requiring that at least one of them aligns with the From header domain. It tells receivers what to do when neither does.
SPF, DKIM and DMARC alignment
Authentication alone is not enough. DMARC requires that the domain authenticated by SPF or DKIM matches the domain in the From header the recipient sees.
The SPF 10-lookup limit
Every include, a, mx, ptr and exists mechanism in an SPF record costs one DNS lookup. The specification caps the total at ten, and exceeding it is a permanent error.
DMARC aggregate reports
Aggregate reports are XML files that receiving domains send to the address in your rua tag. They show who is sending mail as your domain, and whether it passes or fails.