CertaDNS
Skip to lesson

Selectors · lesson 2 of 3

One selector per sender

After this lesson you can

Design a selector scheme that lets you revoke one sender without touching the others.

Assumes you have read Selectors are not enumerable.

A selector is a name for one key. The design question is how many keys, and the answer follows from a single test: what do you have to break in order to remove one sender?

One key for everything

A single key shared by every platform is the arrangement that arrives by accident — one key was generated, and each new vendor was handed a copy. It has one property worth naming: there is no way to revoke a sender. Withdrawing the key from a departing vendor withdraws it from everyone, and every platform must be reconfigured in the same maintenance window.

It is also the arrangement in which a single vendor breach compromises the signing identity of all your mail.

One selector per sender

google._domainkey        Google Workspace   (human mail)
mktg2026._domainkey      marketing platform
txn2026._domainkey       transactional platform
helpdesk._domainkey      support system
  • Removing a vendor is one record, and affects nothing else.
  • A compromise is scoped to the mail that vendor sends.
  • Rotation can be staged per platform rather than as one large event.
  • The selector name tells the next person what the key is for.

Naming

SchemeExampleAssessment
Purpose plus datemktg202609Best. Says what it signs and when it was issued, so a stale key is visible at a glance.
Purpose onlymarketingFine, until you rotate — the successor needs a different name.
Vendor namesendgridPublicly advertises your stack, and becomes wrong the moment you switch vendor.
Sequentials1, s2Opaque. Usually imposed by the platform rather than chosen.
Date only20260901Rotates well, says nothing about purpose. What Google does.

The date component is what makes rotation painless: a new key gets a new name, both coexist for the overlap, and there is never a moment where one name has to mean two keys.

You will not always get the choice

Most platforms name their own selector and many use a fixed one. Where a vendor offers no choice, the separation you want still exists — it is one key per vendor either way. Reserve the naming discipline for the keys you generate.

Try it on a real domain

Free, no account, public DNS only.

Last reviewed