DKIM keys, selectors and rotation

DKIM signs outgoing mail with a private key; the matching public key sits in DNS so receivers can verify the signature. A valid signature proves the message body and key headers were not changed and that whoever holds the private key authorised the message.

Selectors

The signature header names a domain (d=) and a selector (s=). The receiver fetches selector._domainkey.domain as a TXT record. Selectors let one domain publish several keys at once: one per sending service, and a new one during rotation. Because the selector is chosen by the sender, a checker cannot know it in advance; whois.me.uk tries sixty common names, and the header decoder reads the real one from a message.

The record

v=DKIM1; k=rsa; p=MIIBIjANBgkq...

p= is the base64 public key. An empty p= revokes the key. t=y marks it as testing. The Mail facet parses the key and reports its size: 2048-bit RSA is the standard, 1024 is tolerated, anything smaller is rejected by major receivers.

Rotation

Publish a new selector, switch the signer to it, wait a few days for in-flight mail, then remove the old record. Never delete the old key the moment you switch.

Alignment

For DMARC, the d= domain must match the From address domain (relaxed alignment allows a subdomain). A newsletter tool signing with its own domain passes DKIM but does not align; configure custom-domain signing with the provider.

Ed25519

RFC 8463 allows Ed25519 keys, which are tiny and fast. Support among receivers is still uneven, so publish RSA as well.