DKIM selector

It lets one domain publish several signing keys at once, each under its own name.

Which is what makes key rotation possible without an interruption: publish the new key under a new selector, start signing with it, and retire the old one once no message in flight still references it.

It also lets different systems sign for the same domain independently — a transactional platform and a marketing platform each with their own key.

The name itself carries no meaning to the protocol. Providers use recognisable conventions purely so humans can tell which key belongs to what.

A key published with an empty value is a deliberate revocation: the selector exists and authenticates nothing.

DNS has no operation that lists the names existing under a domain. A resolver answers questions about names you already know.

A receiver never needs such an operation, because every message hands it the selector in the signature header.

An external checker has no message, so it can only try names it already knows — the conventions the common providers use.

Which means a domain signing under a randomly generated selector produces an empty result from any external check, including this one.

That is a property of DNS rather than a gap in a tool, and a checker claiming to have found all of a domain's selectors is claiming something impossible.

Open the raw headers of a message the domain really sent — every mail client has a way to show them.

Find the DKIM signature header and read the selector from it, which is one of the tagged values inside.

Query that name directly to retrieve the key, which confirms both the selector and that the key is published.

That is the only reliable method from outside, and it takes about a minute.

Your sending platform's own documentation usually states which selectors it uses, which is the faster answer where a platform is involved.

Publish the new key under a new selector, and wait for DNS to propagate before doing anything else.

Switch signing to the new selector, which most platforms expose as a setting.

Leave the old key published long enough that any message already in flight can still be verified — days rather than minutes.

Then remove the old record, or publish it empty as an explicit revocation.

Removing the old key first is the mistake that breaks verification for every message still in transit.

The conventional selector names used by common providers are queried, and any keys found are retrieved and parsed.

A key that parses is reported as published. That is not evidence that messages are signed, which is a separate configuration on the sending side.

An empty result is reported as no conventional selector answering, explicitly not as the domain being unsigned.

No signature is validated, because validating one requires a message the scan does not have.