DKIM

DKIM adds a signature to each message. Receivers check it against a public key published in your DNS under a selector, for example s1._domainkey.example.com.

What matters

1. Each sending service signs with its own key and selector, given to you in its setup.
2. DNS cannot list your selectors. Mailglo finds selectors in reports, or you add the ones you know.
3. For DMARC, the signature must be for your domain or a parent of it (alignment), not only the service's own domain.

In Mailglo

Authentication settings show known selectors. A DKIM change publishes a service's public key; with hosted records, Mailglo serves the key at the selector you delegate. Your sending service keeps the private key and signs your mail; Mailglo never holds private keys.