DKIM Setup Guide: Selectors, DNS Records and Common Failures

What a DKIM selector does

A selector is a label that tells receivers which DKIM public key to retrieve. If the message header says s=selector1 and d=example.com, the receiver looks for selector1._domainkey.example.com.

Using selectors lets a domain rotate keys and support multiple sending platforms without placing every key at one DNS hostname.

Publish the exact record your provider gives you

Some providers use a TXT record containing the public key. Others use CNAME records that point to provider-managed DKIM records. Copy the value exactly and respect the provider's instructions.

Do not add quotes manually unless your DNS interface requires them. DNS control panels often display formatting differently from how resolvers return the record.

Enable signing in the sender

Publishing a record is only half the job. The outgoing platform must actually sign messages using the corresponding private key.

Send a real message to an external mailbox and inspect the DKIM-Signature header. Confirm that the d= domain and s= selector match the intended configuration.

Understand common failure reasons

A DKIM failure can come from a missing selector record, an incorrect public key, a signature created by a different domain, message modification after signing, or a sender that is not actually using the expected DKIM configuration.

Compare the message header with DNS rather than checking DNS alone.

Rotate keys safely

Key rotation improves security, but removing the old selector too quickly can create failures for messages still in transit. Add the new key, enable signing, verify it, then retire the previous selector according to the provider's guidance.

Document selectors by platform so future troubleshooting does not turn into a search across unknown DNS entries.