A DKIM selector is the s= value in a DKIM signature header. The receiver combines it with the signing domain to find the public key in DNS at <selector>._domainkey.<domain>.
Why it matters
Selectors let one domain use several keys at the same time: one for the main mail system, another for a marketing provider, and a new one when you rotate keys without breaking in-flight mail. Rotating keys periodically limits damage if a private key leaks. Providers choose their own selector names, such as s1, google or selector1, so you often must read the signature to know what to look up. A missing record for the selector is a common cause of dkim=fail (no key for signature).
Example
Signature header:
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=2026a; h=from:to:subject; bh=...; b=...The receiver queries:
$ dig +short TXT 2026a._domainkey.example.com
"v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."Publish the new selector, switch the signer to it, and retire the old one after a delay.
Common mistakes
- Deleting the old selector right after rotating, breaking mail still in transit or queued.
- Entering the selector with the full hostname when the provider asks only for the prefix.
- Splitting a long key into the wrong number of TXT strings.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.