Look up <selector>._domainkey.<domain> and decode the public key + algorithm. Useful for verifying DKIM rotations, debugging delivery failures, and checking provider migrations.
A selector is a label that lets a domain run multiple DKIM keys at the same time, e.g. for key rotation or different mail providers. The full TXT name is <selector>._domainkey.<domain>.
Common defaults: google, default, k1, mailgun, selector1/selector2 (Microsoft), s1/s2 (Mailchimp), 20210112 (Google rotated). If you can read a real email from the sender, the DKIM-Signature header has s=<selector>.
TXT records cap at 255 chars per string. Most DNS hosts auto-split a longer DKIM into multiple <255-char strings the resolver concatenates. If your provider does not, use a 1024-bit RSA key (shorter base64) or the dedicated `_domainkey` UI on the DNS host.
DKIM is useful on its own (it survives forwarding) but you only get the policy lever from DMARC. Publish all three: SPF, DKIM, DMARC.