GUIDE
DKIM: selectors, key length and rotation
DKIM signs your messages with a private key; the public key lives in DNS under a selector.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message. The receiver fetches the public key from selector._domainkey.yourdomain.com and verifies the signature.
Selectors
The selector is chosen by whoever signs the mail (Google uses google, Microsoft 365 selector1/selector2). You can publish many selectors — one per sending system.
Key length
Use 2048-bit RSA. 1024-bit keys are still accepted but discouraged; anything shorter is rejected by major receivers.
Rotation
Rotate keys yearly: publish the new selector, switch signing, then remove the old record after a week.
Check any selector with the DKIM Lookup or create a new key with the generator.