Glossary
Email authentication
Selector
A label that namespaces a DKIM key, so one domain can publish many. The public key lives at {selector}._domainkey.{domain}, and the signature names the selector it used.
Defined in RFC 6376 §3.1.
Where this appears
The lessons that use this term, and what each is for.
Email Authentication FundamentalsSelectors, and finding the keyLocate a domain’s DKIM public keys when nobody remembers the selector names.Email Authentication FundamentalsJudging a key: length, test mode, revocationLook at a published DKIM key and decide whether it should still be in use.DKIM PractitionerDKIM-Signature, tag by tagRead any DKIM-Signature header and state what each tag contributes to the verification.DKIM PractitionerAnatomy of a key recordRead every tag in a DKIM key record and say what each one permits or forbids.DKIM PractitionerRevocation, and the empty p=Revoke a key correctly, and recognise a revoked key when you meet one.DKIM PractitionerSelectors are not enumerableExplain why a domain’s DKIM keys cannot be listed, and find the ones in use anyway.DKIM PractitionerOne selector per senderDesign a selector scheme that lets you revoke one sender without touching the others.DKIM PractitionerCNAME delegation, and who holds the keyChoose between publishing a key and delegating the record, and say who can sign either way.DKIM PractitionerWhat rotation is actually forState what rotating a key mitigates, and what it does not.DKIM PractitionerThe overlap windowSize a rotation’s overlap from TTL and delivery latency rather than from habit.DKIM PractitionerRotations that lose mailName the four ways a rotation destroys signatures, and the check that catches each.DKIM PractitionerNo key for signatureSeparate a missing key, a wrong selector and a broken delegation from one another.DKIM PractitionerShared keysDetermine whether a vendor signs your mail with a key thousands of other domains also use.DKIM PractitionerWhat decaysFind the selectors, delegations and vendors that have quietly stopped being correct.DKIM PractitionerThe day a private key is exposedWork through an exposure in an order that ends the abuse without stopping your own mail.Email Security PractitionerA sending account that is not yours any moreRespond to a compromised platform account that is sending authenticated mail as you.Email Security PractitionerWhat steady state involvesDefine the recurring work that keeps a finished programme finished.Domain Trust ArchitectureHandover that survivesProduce the documentation that lets a successor run the programme without you.