2

It is possible to set a "subdomain" in DKIM DNS record name. This "subdomain" is called a selector. It allows to have multiple DKIM keys for the same domain.

There is something I do not understand during the DKIM verification.

Let's suppose Bob sends a mail to Alice. How Alice mailserver should know this selector ? This selector is not shown in DMARC record (and anywhere else) so how destination mail server can know the selector name ?

Thanks

Improve this question

4 Answers 4

Reset to default
4

It's contained in the DKIM header.

Example:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=default;

This corresponds to the txt record under the following DNS record:

default._domainkey.example.com

Improve this answer
2

If you have an email, you can look at the s= field. If you don't, or the email is old enough that the selector doesn't exist anymore, you can look up the domain on registry.prove.email, that has over 900,000 unique domain-selector pairs. If someone has contributed that selector before, you can get the historical DKIM key values for that domain. In real time, you'd be able to hit DNS, but for past emails, you'd need to hit a historical registry like this.

Improve this answer
4
  • 1
    Mail servers don't need historical records.
    – Esa Jokinen
    Mar 21 at 5:29
  • It's nice to have historical DKIM keys, since then you can verify old emails!
    – John Targaryen
    Mar 23 at 23:39
  • The receiving server verifies the message when it arrives and adds authentication results. I don't really see why anyone would need to get back to it later. If that was a thing, the receiving server would have added a copy of the DKIM key into the headers, too.
    – Esa Jokinen
    Mar 24 at 5:30
  • You might want to prove receipt of the email after the fact, for instance for whistleblowing or as a receipt.
    – John Targaryen
    Mar 25 at 10:41
1

The DKIM-Signature header field in the e-mail message itself contains the selector used (as well as the d= domain) as a mandatory part of the signature / header:

RFC 6376

s= The selector subdividing the namespace for the "d=" (domain) tag
  (plain-text; REQUIRED).

  Internationalized selector names MUST be encoded as A-labels, as
  described in Section 2.3 of [RFC5890].

  ABNF:

  sig-s-tag    = %x73 [FWS] "=" [FWS] selector

  ... 

    INFORMATIVE EXAMPLE of a signature header field spread across
    multiple continuation lines:

   DKIM-Signature: v=1; a=rsa-sha256; d=example.net; s=brisbane;
      c=simple; q=dns/txt; [email protected];
      t=1117574938; x=1118006938;
      h=from:to:subject:date;
      z=From:[email protected]|To:[email protected]|
       Subject:demo=20run|Date:July=205,=202005=203:44:08=20PM=20-0700;
      bh=MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI=;
      b=dzdVyOfAKCdLXdJOc9G2q8LoXSlEniSbav+yuU4zGeeruD00lszZVoG4ZHRNiYzR

which the corresponds to a brisbane._domainkey.example.net DNS record

Improve this answer
0

The selector is on the DKIM-Signature header that is added to the email by the signer, along with the signing domain identifier (SDID).

The selector is on the s= tag and, together with the domain in the d= tag, you have everything you need to look up the record on the DNS.

This selector is not shown in DMARC record

The selector should be present in the <record><auth_results><dkim><selector>...</selector></dkim></auth_results></record> element. Although I wonder why a reporting server would leave the selector out, its presence is not a strict requirement.

Improve this answer
2
  • I have no DKIM-Signature header in the mail I am sending. But DKIM verification is still working ! Do you think some mail server looks at default selector by default ? Thanks
    – Bob5421
    Sep 13, 2022 at 15:36
  • When one is setting up DKIM one must choose a selector to use on one's email software, and configure DNS accordingly. There's no default value for the selector. If your emails are being signed somehow, that's because some server along the way is doing it. Debugging this is simple: check the domain (d=) tag on the signature headers, and you'll see the DNS domain name that added the signature.
    – fvsdpl
    Sep 15, 2022 at 7:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .