DKIM Selector is the short string that identifies which DKIM key pair to use when verifying a signed email. It’s embedded in the DNS name where the DKIM public key lives, letting you publish multiple keys under one domain and rotate them independently.
DNS Format
{selector}._domainkey.{domain}. TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4..."Real example:
google2024._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIGfMA0G..."The selector here is google2024.
In the Signed Email
DKIM signatures include a s= (selector) tag pointing to the DNS record to fetch:
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=google2024;
h=from:to:subject:date; bh=...; b=...;Receiver: read d= and s= → fetch google2024._domainkey.example.com → find p= → verify signature.
Why Selectors Matter
- Key rotation — publish a new selector, sign with the new key, keep the old selector live until in-flight mail is delivered, then remove the old selector’s DNS record
- Multi-provider setups — Google Workspace, SendGrid, Mailchimp each use their own selector so you can have valid DKIM signatures from all of them simultaneously
- Selector naming convention: date-based (
202409), provider-based (sendgrid1), or purpose-based (transactional)
Look up DKIM records for any domain with the DKIM lookup tool.
Related
Read what DKIM is, check the DKIM glossary entry, and see what an SPF record is for the parallel authentication mechanism.