A selector is a name for one key. The design question is how many keys, and the answer follows from a single test: what do you have to break in order to remove one sender?
One key for everything
A single key shared by every platform is the arrangement that arrives by accident — one key was generated, and each new vendor was handed a copy. It has one property worth naming: there is no way to revoke a sender. Withdrawing the key from a departing vendor withdraws it from everyone, and every platform must be reconfigured in the same maintenance window.
It is also the arrangement in which a single vendor breach compromises the signing identity of all your mail.
One selector per sender
google._domainkey Google Workspace (human mail) mktg2026._domainkey marketing platform txn2026._domainkey transactional platform helpdesk._domainkey support system
- Removing a vendor is one record, and affects nothing else.
- A compromise is scoped to the mail that vendor sends.
- Rotation can be staged per platform rather than as one large event.
- The selector name tells the next person what the key is for.
Naming
| Scheme | Example | Assessment |
|---|---|---|
| Purpose plus date | mktg202609 | Best. Says what it signs and when it was issued, so a stale key is visible at a glance. |
| Purpose only | marketing | Fine, until you rotate — the successor needs a different name. |
| Vendor name | sendgrid | Publicly advertises your stack, and becomes wrong the moment you switch vendor. |
| Sequential | s1, s2 | Opaque. Usually imposed by the platform rather than chosen. |
| Date only | 20260901 | Rotates well, says nothing about purpose. What Google does. |
The date component is what makes rotation painless: a new key gets a new name, both coexist for the overlap, and there is never a moment where one name has to mean two keys.
You will not always get the choice
Most platforms name their own selector and many use a fixed one. Where a vendor offers no choice, the separation you want still exists — it is one key per vendor either way. Reserve the naming discipline for the keys you generate.