Selectors, and finding the key

A domain usually needs several DKIM keys at once — one per sending platform, plus spares for rotation. Selectors are how they coexist.

Where a key lives

{selector}._domainkey.{domain}    TXT

So the key with selector s1 for github.com is a TXT record at s1._domainkey.github.com. The selector is chosen by whoever provisions the key and carries no meaning — s1, selector1, 20230601, k1 and mandrill are all just labels.

Finding the selectors when nobody remembers

Here is the awkward part: there is no way to list a domain’s selectors. DNS has no mechanism for enumerating names under a prefix. You cannot ask "what selectors does this domain have"; you can only ask whether a specific one exists.

Three approaches, in order of reliability:

• Read a real message. The s= tag in its DKIM-Signature header names the selector exactly. This is the only method that gives a definitive answer, and it needs only one message from each sender.
• Guess the platform’s convention. Each platform uses a predictable pattern — Microsoft 365 uses selector1 and selector2, Google Workspace defaults to google, SendGrid uses s1 and s2. Guessing works often and proves nothing when it fails.
• Read your DMARC aggregate reports. They name the signing domain for every source, which tells you who to go and ask.

s1.domainkey.u51742174.wl175.sendgrid.net.
"k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyn3fMCVpb7ryIRKOGXhXVGYm..."

Delegation by CNAME

That example shows the pattern most platforms use. Rather than asking you to paste a public key into your zone, they ask for a CNAME pointing at a name they control:

s1._domainkey.github.com.  CNAME  s1.domainkey.u51742174.wl175.sendgrid.net.

The advantage is real: the platform can rotate its key whenever it likes without you touching anything. The trade is that you have delegated a piece of your namespace, and if you stop using that platform and leave the CNAME behind, you have a record pointing at infrastructure you no longer control. Retire DKIM CNAMEs when you retire the vendor.

Microsoft 365 uses the same mechanism, pointing back into the tenant domain:

selector1-microsoft-com._domainkey.microsoft.onmicrosoft.com.

The tags in a key record

v=DKIM1; k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEF...

• v=DKIM1 — version. Optional, and if present it must come first (RFC 6376 §3.6.1).
• k=rsa — key type. rsa or ed25519. Defaults to rsa.
• p= — the public key, base64. An empty p= means the key is revoked, and receivers must treat signatures using it as failures.
• t= — flags. t=y is test mode; t=s forbids subdomains from using this key.