What is DKIM selector?
A DKIM selector is a label placed in a DNS record name so a receiving server knows which public key to use when checking the DKIM signature on an email.
When a sender signs a message with DKIM, the signature header names a selector and the signing domain. The receiver combines them into a DNS lookup, such as selector underscore domainkey dot your domain, and fetches the public key published there.
Selectors let one domain use several keys at once. Your email platform, your helpdesk and your invoicing tool can each sign with a different selector, and you can rotate a key by publishing a new selector before retiring the old one.
Many platforms give you the selector and the record value to paste into DNS. If the selector in the record does not match what the platform signs with, authentication fails even though a record exists.
A worked example.
Picture a furniture store whose email platform asks it to publish two records named after two selectors. The owner adds only one. Test sends show DKIM failing in the message headers. After the second record is published and DNS has propagated, the next test shows DKIM passing and DMARC alignment holding.
Common mistakes.
- Copying only some of the records the platform provides
- Adding extra characters or quotes when pasting the key into DNS
- Deleting an old selector before every sender stopped using it
Want this handled for your store? See our email deliverability service or book a free audit.
Guides that use this.
Find out what your list is actually worth.
We review your flows, list health, authentication records and last ninety days of performance, then send back what we found.
30 minutes, no obligation, and the findings are yours to keep either way.