Start with your sending-provider inventory and recent real messages. Extract d= and s= from DKIM signatures.
Query each selector and map it to a system owner.
Classify selectors as active, migration overlap, unknown or retired.
Before removing an old public key, confirm the old sender is no longer signing mail and allow normal queued messages to clear.
Unknown selectors deserve investigation, but a DNS record alone does not prove somebody possesses the private key.