The sending system hashes selected headers and the body, signs with a private key, and writes a DKIM-Signature header. Tags you will see: v=1, a=rsa-sha256, d= signing domain, s= selector, bh= body hash, b= signature. The public key is a TXT record at s._domainkey.d.
Selectors exist so you can rotate keys
Two records — s1 and s2 — let you publish a new key, switch signers, then retire the old p= (empty p revokes). Microsoft 365’s selector1/selector2 pair is this idea in production. If lookup fails, you likely guessed the selector. Copy it from a real sent message instead.
Alignment with DMARC
A valid DKIM signature on d=mailer.vendor.com does not help DMARC for From: you@example.com unless you use a custom signing domain. That is why ESPs ask you to add CNAMEs or TXT records under your own _domainkey. Check with the DKIM tool. Stack context: email authentication.