DKIM selector

What it means

Selectors let one domain publish many DKIM keys at once. A signature with d=example.com and s=mail2026 is checked against the key at mail2026._domainkey.example.com. Giving each sending service its own selector lets a mailbox provider, a marketing platform and a ticketing system all sign for the same domain without sharing a private key.

Selectors are also how keys are rotated: publish a new key under a new selector, switch signing to it, and remove the old one once mail signed with it has been delivered. Microsoft 365, for example, gives each custom domain two selectors (selector1 and selector2) and alternates between them.

Selector names are chosen by the signer and can contain dots. There is no way to list a domain's selectors from DNS, so lookup tools need the selector, which you can read from the s= tag of a signed message.