Marketing signs as s=klaviyo. Receipts are about to sign as s=klaviyo too, because you copied the DNS host from the first setup. The second TXT publish replaces the first key. Campaigns start failing DKIM on random days, depending on which record won. That is a selector collision, not a bad template.
DNS holds one TXT record per selector name, so two services on one selector means one of them fails DKIM every time. The fix is a naming change, not a new key, but it only restores DMARC if each service also signs with d= on your domain.
Last verified: 26 September 2026, against RFC 6376.
What the selector is for
DKIM puts a selector name in the signature. The receiver fetches the public key from DNS at that name. The domain in d= is the domain you are claiming. The selector is which key on that domain. Alignment is whether d= matches the From domain. A selector can be unique and still fail alignment if d= is the vendor’s domain. How SPF, DKIM, and DMARC fit together is the primer if the three checks still blur.
You want both: d= on your domain, and a selector that belongs to the service that holds the private key.
One DKIM selector per signer
| Setup | What happens |
|---|---|
Klaviyo on s=kl, receipts on s=ses |
Both keys exist. Each signature finds its own TXT. |
Both services told to use s=default |
One TXT. The service whose key is not published fails DKIM. |
| New key published on the old selector before the signer switches | Messages still signed with the old key fail until every server has the new key. |
| Old selector deleted the hour you rotate | Mail already signed, including retries, fails DKIM. |
The alignment guide names the shared-selector mistake in one line. This page is the rule: the selector namespace is how multiple senders share a domain without sharing a key.
SPF’s 10-lookup limit is the other bill for a second ESP. Selectors do not fix a permerror. You still need an SPF mechanism for the new sender, or you rely on aligned DKIM for DMARC and leave SPF wrong. Do not leave SPF wrong.
DKIM selector rotation without a gap
- Ask the vendor for the new selector and the TXT value. Do not overwrite the live selector’s TXT while production still signs with the old key.
- Publish the new name. Check it with the DKIM record checker or a DNS lookup, not only the vendor’s dashboard.
- Turn signing over to the new selector.
- Send a campaign and a receipt if both exist. Read
s=andd=on each. - Remove the old selector after in-flight mail has drained. There is no RFC timer for that wait. A day is a common operating choice. It is not a provider requirement.
If DMARC reports show a source failing DKIM on your domain after a rotation, the usual cause is a server still on the old selector, or a second product you forgot. Unknown senders is that hunt. DKIM failing is the short checklist when the signature is simply invalid. Once every selector aligns, moving DMARC to enforcement is the next step.
InboxEagle
Check that each DKIM selector resolves
The free DKIM checker looks up any selector on your domain and shows the published key. Run it for every service that signs as you, before and after a rotation.