DKIM selector
The name in a DKIM signature that tells the receiver which public key to fetch from the signing domain's DNS.
See it
What it is
A DKIM selector is the label that chooses one public key among all the keys a signing domain may publish. The message names it in the DKIM-Signature header's 's=' tag. A receiver combines that selector with the 'd=' signing domain and looks up 'selector._domainkey.domain' in DNS to find the verification key.
Selectors let Amazon SES, Postmark, a helpdesk, and an in-house mail server sign for the same domain without sharing one private key. They also make rotation possible: publish a fresh key under a new selector, switch the signer, then retire the old selector after an overlap.
The common mix-up is treating the selector as the domain being authenticated. DMARC alignment looks at the 'd=' domain, not the selector, and a friendly name like 'google' proves nothing by itself. Debug from the actual 's=' and 'd=' tags on a received message, because querying the selector you remember from last year may only find an obsolete key.
Ask AI for it
Trace the DKIM key used by the raw Gmail 'Show original' headers I paste. Read each DKIM-Signature header separately, extract its RFC 6376 's=' selector and 'd=' signing domain, construct the exact DNS name '<selector>._domainkey.<d-domain>', and give me the matching 'dig TXT' command. Compare the returned key record with the signature's 'a=' algorithm and report whether the selector is present, revoked with an empty 'p=' value, malformed, or simply not yet visible. Then use Authentication-Results to say which signature the receiver passed and whether its 'd=' domain aligns with the visible From domain. Do not infer a selector from a provider name or query the From domain unless the 'd=' tag actually names it.