Some platforms give each customer their own key. Some sign every customer’s mail with one key and delegate every customer’s selector to the same name. Which you have is visible in a single query, and most people have never run it.
The test
Resolve your selector’s CNAME, then resolve someone else’s on the same platform. If the targets are identical, the key is shared.
dkim.mcsv.net. dkim.mcsv.net. dkim.mcsv.net.
Compare with a platform that issues per-account names:
s1.domainkey.u51742174.wl175.sendgrid.net. s1.domainkey.u2680008.wl009.sendgrid.net.
What a shared key means
- One private key signs for every customer. It is held by the platform and used across the whole estate.
- A compromise is not scoped to you — and neither is the remediation. You cannot rotate it; you can only stop pointing at it.
- It is not a spoofing hole. Another customer cannot sign as your domain with it: the signature would carry their
d=, and alignment would fail. The key signs on behalf of whichever domain the platform decides to sign for, and that decision is theirs, not the key’s. - The real exposure is the platform’s account security. If someone compromises your account there, they can send authenticated, aligned mail as you — and the key being shared or dedicated makes no difference to that.
How much to care
Less than the phrase “shared key” suggests, and not nothing. A shared key raises the value of a single target: the platform’s key store now protects thousands of domains rather than one, which makes it worth far more to steal. You have no visibility into how it is protected and no ability to rotate it.
Worth asking, not worth switching for
For transactional mail, and for any platform sending on behalf of a domain you care about, a dedicated key is the right thing to ask for and most platforms offer one on paid tiers. It is rarely a reason on its own to change vendor. It is a reason to keep that vendor on its own selector, so that withdrawing them is one record.