DKIM selector mismatch in cold email

A DKIM selector mismatch is one of the easiest cold email setup mistakes to miss. The sending tool says DKIM is enabled, but the public key receivers query is missing, under a different selector, in test mode, or published on the wrong domain. The message sends, but authentication does not verify the way the launch checklist expects.

How selector mismatch happens

Every DKIM signature includes s= for selector and d= for signing domain. Receivers query:

selector._domainkey.signing-domain

Mismatch happens when the DNS record is created for google._domainkey, but the message signs with selector1; when the record is published on the root brand domain but mail signs with the sending subdomain; or when a provider rotates selectors without updating the launch checklist.

How to verify it

Do not guess common selectors only. Send a test message, inspect the DKIM-Signature header, then check the exact selector and signing domain. Also confirm the key is active, long enough, and not in t=y test mode.

OutboundQA probes common selectors and stores discovered selector evidence, then monitoring can watch the last discovered selector for disappearance.

FAQ

What is a DKIM selector mismatch? A DKIM selector mismatch happens when the message is signed with one selector but DNS publishes a different selector, no selector, or an inactive test key.

How do I find the DKIM selector my mail uses? Send a test message, inspect the DKIM-Signature header, and read the s= value. That value is the selector to verify at selector._domainkey.yourdomain.

Can DKIM pass but DMARC still fail? Yes. DKIM must pass and align with the visible From domain for DMARC to use it. A provider-domain DKIM signature can pass without helping DMARC.