What is a DKIM selector?

The selector is a freely chosen name that makes the key unique under your domain. It allows several keys in parallel, for example during a rotation.

Where do I publish the DKIM key?

As a TXT record at selector._domainkey.your-domain.com. The value starts with v=DKIM1 and carries the public key in the p= field.

Why does the test say the key was not found although the record exists?

A cached negative answer in DNS can hide a fresh change. sender.report therefore also asks external resolvers and lets you query again with one click.

Check and set up DKIM: selector, key length and typical mistakes

DKIM (DomainKeys Identified Mail) adds a signature to every message. You publish the matching public key in DNS, and the receiver uses it to verify that the message came from your domain and arrived unchanged.

How DKIM works

Your mail server signs outgoing mail with a private key and writes the signature into the DKIM-Signature header. It names the domain (d=) and the selector (s=). Together they give the name of the DNS entry that holds the public key.

dkim._domainkey.example.org.  IN TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A…"

Recommendations

Use RSA keys with 2048 bits. 1024 bits are still valid, Gmail and others recommend 2048.
Sign with rsa-sha256. rsa-sha1 is deprecated by RFC 8301.
The signing domain (d=) should match the visible From domain so DKIM counts for DMARC.
Rotate keys now and then and publish a new selector for it.

Common mistakes

The key is missing in DNS or sits under another selector than the signature names.
The record holds several TXT entries, an empty p= (a revoked key), or line breaks and quotes that were copied along when pasting into the DNS panel.
The content changed after signing, for example through a footer, a disclaimer or a mailing list. The body hash no longer matches.
The l= tag (body length) allows content to be appended and strict verifiers reject it.

How to check it

Send a test mail to sender.report. The report names the selector, the domain and the DNS name it queried, and says whether the record is missing, malformed or the DNS server did not answer. After a DNS change you query everything again with one click.

Check and set up DKIM