What DKIM selector means
A domain may publish as many DKIM keys as it has senders, and the DKIM selector is what keeps them apart. The s= tag in the DKIM-Signature header names a label, and the verifier fetches the TXT record at that label under _domainkey: a signature carrying s=mail sends the verifier to mail._domainkey.example.com.
Selectors exist for rotation and for delegation. Rotating a key means publishing a new selector, switching the signer over to it, and removing the old record only once no mail signed under the old key is still in flight — never editing a record in place, because messages already sent are still being verified against it. Delegation means every provider that sends on your behalf gets a selector of its own, so withdrawing one sender's ability to sign is a single DNS deletion.
Selectors cannot be enumerated. DNS offers no way to list the labels published under _domainkey, so a checker has to be told which selector to ask for, or read it from the s= tag of a message the domain actually signed. If you do not know yours, send a message to an address you control and read the DKIM-Signature header of what arrives.
See it on your own domain. Every term in this glossary is something one of the eleven checks reads and reports.
Browse the lookupsKeep reading
Related checks, definitions and guides.