DKIM

DKIM adds a signature to each message. Receivers check it against a public key published in your DNS under a selector, for example s1._domainkey.example.com.

What matters

1. Each sending service signs with its own key and selector, given to you in its setup.
2. DNS cannot list your selectors. SendBop finds selectors in reports, or you add the ones you know.
3. For DMARC, the signature must be for your domain or a parent of it (alignment), not only the service's own domain.

In SendBop

Authentication settings show known selectors. A DKIM change publishes a service's public key; with hosted records, SendBop serves the key at the selector you delegate. SendBop never holds your private keys and does not sign email.