A DKIM selector is a short label that lets a domain publish more than one DKIM public key and tells receivers which one to use to verify a given message. Defined in RFC 6376, the selector appears in the message's DKIM-Signature header as the s= tag, alongside the signing domain in d=.
The receiver combines the two to build a DNS query. For selector mail and domain example.com, it looks up the TXT record at mail._domainkey.example.com. That record holds the public key in its p= tag (with the key type in k=), which is used to check the cryptographic signature. An empty p= revokes the key, and t=y marks it as test mode.
Selectors matter because they make key rotation and multi-provider sending practical. You can add a new selector with a fresh key, switch your signer to it, and retire the old one, all without breaking verification mid-flight. Each sending service typically uses its own selector.
To check a selector, query the relevant selector._domainkey TXT record and confirm a valid, suitably strong key (2048-bit RSA is recommended over weaker 1024-bit keys). A missing or malformed record means DKIM cannot pass.
Check it on your domain
- DKIM Checker: look up and validate a DKIM public key by selector.
- DKIM Generator: generate a DKIM key pair and DNS record in your browser.