One domain. Several keys. Which one?A receiving server just got an email that claims to be from you. To trust it, it needs your public key. But your domain might be publishing several keys, one for your newsletter, one for receipts, one for Google Workspace. So which key does it grab? That's the whole job of a DKIM selector.
⬡ record-cards, three key cards under one domain: newsletter · receipts · workspace, a question mark hovering over "which key?"A DKIM selector is just a short label. It rides along in the DKIM-Signature header as the s= tag, and it tells the receiver exactly where in DNS to go find the matching public key. Think of it as the aisle number for your key.
⬡ dissect, highlight the s=harbor tag inside a DKIM-Signature: header lineHere's the pattern the receiver builds, and it never changes. It's {selector}._domainkey.{domain}. So if your selector is harbor and your domain is deepcurrent.io, the server looks up harbor._domainkey.deepcurrent.io. That's a real DNS name it queries. The selector is literally the first piece of the address.
⬡ terminal, dig TXT harbor._domainkey.deepcurrent.io returns a v=DKIM1; k=rsa; p=... public key recordOne selector per sender.Now, why publish several selectors? Because different systems sign your mail. Your ESP uses one, your receipt provider another, your Workspace a third. Each gets its own key pair and its own selector. And here's the payoff: if one key ever gets compromised, you retire just that selector. The other senders keep sailing, untouched.
⬡ record-cards, three selector cards each pointing to its own key, one card flips red and is pulled while the others stay greenIf that just clicked, subscribe. We're working through every authentication question in the Almanac, one at a time.
Selectors also make swapping keys painless. Instead of overwriting your one key in place, and creating a window where some mail uses the old key and some uses the new, you stand up a brand new selector, switch your signing over to it, then retire the old one once the DNS TTL clears. No gap, no failed mail in flight. That's its own video, linked below.
⬡ timeline, publish new selector, switch signing, wait for TTL, retire old, drawn as an overlap with no gap⬡ title-cardSo a selector is a label that answers one question for the receiver: which of your keys do I check this against? It lets you run several keys at once, and swap them without downtime.
Want to see which selectors are live on your own domain and whether they're returning a valid key? You can check that in about thirty seconds with our free DKIM record lookup. Next up: the safe way to rotate a DKIM key.
⬡ end-card, Subscribe + Next: "A safe DKIM key rotation strategy" (003.011.002)What are DKIM selectors used for? A DKIM selector is a short label in the DKIM-Signature header (the s= tag) that tells a receiving server exactly which public key to fetch from DNS. This video shows the exact lookup the receiver builds, {selector}._domainkey.{domain}, why you'd run several selectors (one per sending system), and how selectors let you rotate keys without downtime.
Check your live selectors → reviewmyemails.com/tools/dkim-checker
Next: A safe DKIM key rotation strategy → [link 003.011.002]
Full written guide → reviewmyemails.com/emailalmanac/003.011.001
#email #DKIM #deliverability