A domain is allowed more than one DKIM key. The selector says which one to use for a given message, and it is the first part of the DNS name the receiver looks up.
How the lookup works
The signature in the email carries two tags that matter here:
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=mail2026; ...The receiver combines them into a DNS name, s._domainkey.d, which here is mail2026._domainkey.example.com, and fetches the public key published there.
Why selectors exist
- Several services. A newsletter tool, a CRM and SES can each sign with their own key under different selectors, without sharing a private key.
- Rotation. You can publish a new key under a new selector, switch signing to it and retire the old one, with no gap in between.
Selectors in Amazon SES
With Easy DKIM, SES assigns three selectors per domain and asks you to publish three CNAME records, one for each. They point at keys AWS holds. With BYODKIM you choose the selector name and publish the public key yourself.
You can read the selectors for a domain in the SES console under the identity’s authentication settings.
Troubleshooting
When DKIM fails, check these in order:
- The record exists at exactly
selector._domainkey.yourdomain.com. - Your DNS provider has not appended the domain a second time.
- The record has finished propagating.
- The
d=domain in the signature matches your From domain, or DMARC alignment will fail even though DKIM passes.
Common questions
Can I choose my own selector in SES?
With Easy DKIM, SES generates the selectors. With BYODKIM you pick the selector name yourself.
How do I know which selector a message used?
Open the full headers of a received message and find the DKIM-Signature header. The s= tag is the selector and d= is the signing domain.