A DKIM verifier takes the selector (s=) and signing domain (d=) from the signature and queries:
selector._domainkey.example.comThe returned record contains key and policy information used to verify the signature.
A simplified record might look like:
v=DKIM1; k=rsa; p=MIIB...Hosted providers may ask you to publish a CNAME instead, allowing the provider to manage the actual key record under its own DNS.
Rotation
Selectors make safe rotation possible. Publish the new key first, switch signing, verify production mail, then retain the old public key long enough for delayed messages signed with it to finish moving through the system.