What is a DKIM selector?

Definition

A DKIM selector is a short label, chosen by the signer, that appears in the s= tag of a DKIM signature. The receiver combines it with the signing domain from the d= tag to build one DNS query:

<selector>._domainkey.<domain>     e.g.  google._domainkey.example.com

The TXT record at that name holds the public key that verifies the signature. The selector is just the lookup key; it carries no meaning of its own, which is why you see values like google, selector1, k1, or a dated s2048-2026 in the wild.

Why selectors exist

Without selectors, a domain could publish exactly one DKIM key, and that would break two things modern email depends on:

• Multiple senders. Google Workspace, your marketing platform, and your helpdesk each sign with their own private key, each published under its own selector on your domain. None of them ever needs to share key material.
• Key rotation. A signer can publish a new key under a fresh selector, switch signing over, and retire the old record later, with no moment where signatures fail. Providers that rotate automatically (Microsoft 365's selector1/selector2 pair, for example) rely on this.

Where to find yours

Open a delivered message's raw source and find the DKIM-Signature: header. The s= tag is the selector and d= is the domain it signs for. A DMARC monitoring dashboard does this at fleet scale: aggregate reports name the selectors seen signing your mail, which is how you spot a vendor signing with a selector that no longer resolves or a key that is due for an upgrade.

Good selector hygiene

• Keep every selector your mail actually signs with published and resolving; a deleted record fails live signatures immediately.
• Use 2048-bit keys where the provider allows it; receivers reject sub-1024-bit keys outright.
• Remove or revoke selectors for services you no longer use, so a stale key cannot be abused later.