What Is a DKIM Selector?
TL;DR
A DKIM selector is a label that tells a receiving server which public key to fetch when it verifies a signature. The key is published as a DNS TXT record at selector._domainkey.yourdomain.com, and the selector name travels with the message in the s= tag of the DKIM-Signature header.
Where does a DKIM selector live in DNS?
The record name is the selector, then the literal label _domainkey, then your domain. Google Workspace uses the selector google by default, so its key is published at google._domainkey.yourdomain.com.
Microsoft 365 does it differently. It asks you to publish two CNAME records, selector1._domainkey and selector2._domainkey, each pointing into a Microsoft-hosted zone, so the key material stays on the provider side and you never copy a public key by hand.
Why do providers use more than one selector?
So that a key can be rotated without a gap. A new key is published under a second selector, signing switches over to it, and the first selector is removed only once no signed mail is still in flight and still being verified.
That is exactly what the Microsoft 365 pair is for: selector2 exists so a rotation has somewhere to land. If only the first record was published, rotation cannot happen.
How do you find the selector a message used?
Read the DKIM-Signature header on a message you received. The s= tag is the selector and the d= tag is the domain, so s=selector1 with d=contoso.com means the key sits at selector1._domainkey.contoso.com.
This is the only reliable way to check a sending stack you did not configure yourself, because a selector name is chosen by the provider and cannot be guessed from the domain.
Frequently asked questions
Yes, and most domains sending through more than one platform do. Each provider signs with its own key under its own selector, and a receiver only ever fetches the one named in the signature it is checking.