DKIM Selector
A DKIM selector names which public key record to query. The signature's s= tag plus the d= domain locate selector._domainkey.domain in DNS.
Why selectors exist
Selectors let you run multiple keys (per ESP, per rotation) without collisions on a single DNS name.
Microsoft 365 note
Exchange Online commonly uses selector1 and selector2 CNAMEs to Microsoft-published keys when you enable DKIM.
How QuickDMARC helps
Track which selectors appear in authentication results and whether they align for DMARC.
Frequently asked questions
Can two ESPs share one selector?
Better to use distinct selectors per signing system.
Where is s= visible?
In the DKIM-Signature header on the message.
Broken selector DNS?
DKIM verify fails even if the private key is correct.