DKIM signs each outgoing email with a private key. Receiving servers check the signature against a public key published in DNS. If the key is missing or wrong, DKIM fails — and without DKIM, DMARC often fails too.
What a selector is
A domain can have many DKIM keys, one or more per sending service. The selector says which key to use. It appears in every signed message, in the DKIM-Signature header:
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector1; ...The receiver looks up the key at:
selector1._domainkey.example.comWhy you cannot list every DKIM key
DNS has no way to ask “show me every selector for this domain”. You can only check a selector you already know. That is why DKIM tools — including Watchvera — check a list of known selectors, and why the best source for an unknown one is the s= value in a real message header.
Microsoft 365: selector1 and selector2
Microsoft 365 uses the same two names for every organisation: selector1._domainkey and selector2._domainkey. Both must be CNAME records pointing to Microsoft’s DKIM infrastructure, not TXT records. Only one selector is active at a time; the other is used after the next key rotation (Microsoft Learn).
Common mistakes:
- Publishing only
selector1, so signing breaks at the next rotation. - Creating TXT records instead of CNAMEs.
- Enabling DKIM for the
.onmicrosoft.comdomain only, so mail from the real domain is unsigned.
Key length
Use 2048-bit keys where the service supports them. Microsoft 365 supports 1024-bit and 2048-bit keys, and a change of size applies at the next key rotation.
DKIM and DMARC alignment
DKIM helps DMARC only when it is aligned: the d= domain in the signature must match the domain in the visible From: address. A marketing tool that signs with its own domain passes DKIM but fails DMARC alignment. Set up DKIM for your domain inside each sending service.
Checklist
- Every service that sends as the domain signs with the domain’s own key.
- Both Microsoft 365 selectors are published as CNAMEs.
- Keys are 2048-bit where possible.
- Old selectors for services no longer used are removed.
Watchvera checks known DKIM selectors on every client domain, shows each key and its length, and keeps every change to these records in the domain history.
See how Watchvera handles this: DMARC, SPF and DKIM monitoring.