Email glossary · Practical guide
DKIM selector: find the key used for one signature
A DKIM selector identifies which public-key record to query under the signing domain. It allows different signing keys to coexist without replacing the domain itself.
Reviewed · Examples are illustrative
Who this helps: Readers checking a term before making an outreach or mailbox decision.
Meaning and common confusion
Look at the actual signature's selector instead of assuming the name used in an old setup guide. Providers can use different selectors or change them during rotation. A valid record at the wrong selector does not help verify the signature currently attached to the message.
Source: RFC 6376: DKIM selector context
Worked example
This is a synthetic illustration, not a customer result or a live configuration to copy.
Signature: d=brand.example; s=outbound2
Relevant name: outbound2._domainkey.brand.example
Existing record: outbound1._domainkey.brand.example
The existing record is not evidence that outbound2 resolves correctly.Checks to make
- Copy selector and domain from the delivered signature.
- Check the exact owner name for duplicate domain suffixes.
- Keep old and new key evidence distinct during rotation.
Next step and limits
Use the selector-not-found guide for resolution errors and the rotation guide for planned changes. Never publish the private signing key. A successful DNS lookup still needs a message-level signature result to verify the sending path.
Source: RFC 6376: DKIM selector context
Source references
Worked examples are illustrative. Editorial procedures are suggested methods, not measured performance claims or promises of additional product features.
Related guides
- DKIM selector not found: query the name in the actual signature →
- DKIM key rotation: switch selectors without stranding in-flight mail →