DKIM Selector Validator

DKIM signs the message with a private key on the sending server, and the recipient fetches the public key from your domain's DNS. What trips people up in setup is the record name: it does not sit directly on the domain, but on a subdomain built from the selector plus the fixed _domainkey label. A selector called mail on example.com becomes mail._domainkey.example.com.

Enter the selector and the domain and the page validates both against DNS label rules — 63 characters maximum, alphanumeric with hyphens allowed in the middle but not at the ends — and assembles the full TXT record name, along with the expected shape of the value. A classic mistake this catches: pasting the name already containing _domainkey into a provider panel that appends the domain again, producing a duplicated record that is never found.

The selector exists so you can hold more than one key at a time, and that is what makes rotation possible without interruption: publish the new key under a new selector, switch the signer to use it, and only remove the old record once every previously sent message has been delivered. Email providers usually pick the selector for you — names like google, s1, selector1 and k1 are common.