The short version
DKIM - DomainKeys Identified Mail - is a wax seal. Your mail server signs each outgoing message with a private key. The matching public key is published in your DNS. A receiver fetches that key, checks the seal, and learns two things: the message really came from your domain, and it was not altered in transit.
Selectors, and why there is more than one key
A selector is a short name that lets one domain publish several keys - one
per service that sends for you. The key for the selector google lives at
google._domainkey.yourdomain.com.
Every service you send through gets its own selector and its own key, which is what lets you switch off one provider's signing without disturbing another's.
Why it matters more than it looks
DKIM is what survives forwarding. A forwarded message reaches the recipient from a server that is not yours, so SPF fails - correctly, and through nobody's fault. The DKIM signature still verifies, so the message still passes DMARC and is still delivered.
That is why moving DMARC to reject with SPF alone eventually bounces real mail: the first time somebody's auto-forward relays your invoice, it disappears.
What DKIM cannot do
It does not say who may send. A valid signature proves a message came from a holder of that key. Only DMARC says what to do when there is no valid signature.
Its absence cannot be proven. Selector names cannot be listed from DNS, so nobody - including this product - can prove a domain does not use DKIM. All anyone can do is try the names the common providers use. See the DKIM check.
What to do
- Turn DKIM signing on in your mail platform. It is a setting on every mainstream provider, not a purchase.
- Publish the DNS records it gives you.
- Send yourself a message and look at the headers - you want
dkim=pass. - Repeat for every other service that sends as you.