As with SPF, DKIM publishes its data via a TXT RR within the zone, in this case the public key used to verify the signed emails.
However, it doesn't end there; the other side of the equation requires that the originating mail server (MTA) also has the DKIM private key installed and signs each outbound message with it.
The receiving servers will them use the public key from the zone's DKIM TXT RR to authenticate the signature on the inbound email, and optionally refer to a DMARC policy to decide how to handle the message.
The DKIM record uses a selector to identify which public key should be used in verifying the signature. Organizations can use multiple selectors for multiple signatures corresponding to any logical distinction of their ...
