DKIM selector
The DKIM selector and signing domain point to the public verification key. It helps map keys to specific sending routes.
A DKIM selector is the identifier in the signature’s s= field. Together with the signing domain, it determines where the receiving side finds the public verification key. DKIM uses a DNS name under _domainkey for this purpose.
Map a specific key
In the fictional test design, message K-658 carries s=mail and d=firma.example. The corresponding DNS name is mail._domainkey.firma.example. This is a constructed example; no key was queried and no signature was checked here.
For operations, the team records which sending service uses this selector and who manages the corresponding record. The selector itself is not a secret key. The presence of a public key also does not establish a valid signature for the specific message.
Coordinate a change with sending
Multiple selectors allow separate keys and an orderly change. When replacing a key, account for messages already sent but not yet checked. Define the transition and verification before removing the old public record. The selector name alone confirms neither a person nor DMARC alignment.
Sources
Related terms
- DomainKeys Identified MailDKIM links signed email components to a domain. A valid signature establishes neither encryption nor the person behind the message.
- TXT recordA TXT record stores text in DNS. The relevant procedure determines how a service interprets it, for example when checking control of a domain.
- Return-PathReturn-Path records the SMTP reverse path in a header. It explains the technical route for error reports, not a person’s identity.
- Envelope-FromEnvelope-From identifies the SMTP sender for transport and error feedback. It must be distinguished from the visible sender address.
- DMARC aggregate reportA DMARC aggregate report summarises a reporting mail system’s domain checks over a period. It helps examine sending sources and misconfigurations.
- DMARC policyA DMARC policy describes the requested handling of failed domain checks. It repairs neither sending sources nor their alignment.
Articles on this topic
Cloud & Operations with ASES
Hosting, deployment, maintenance and support