What DKIM does
DKIM adds a cryptographic signature to outgoing messages. Receivers fetch the public key from DNS (via the selector) and verify the message was not altered in transit.
Selectors
Providers publish keys under names like selector1._domainkey.example.com. Rotating keys usually means adding a new selector and migrating sending systems before retiring the old key.
Alignment
For DMARC to pass on DKIM, the signing domain often needs to align with the From domain depending on your DMARC policy mode—pair DKIM setup with your SPF and DMARC records.