Your mail provider signs each outgoing message with a private key and adds a DKIM-Signature header. That header names the signing domain (d=) and a selector (s=). The receiving server fetches the public key from selector._domainkey.yourdomain and checks the signature against the message body and key headers.
google._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOC..."
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=google; h=from:to:subject:date; bh=...; b=...
Why selectors matter
A domain can have many DKIM keys, one per sending service, each under its own selector. Google Workspace uses google by default, Microsoft 365 uses selector1 and selector2. You only find a key if you know its selector, which is why DKIM checkers try a list of common ones.
DKIM and cold email
DKIM survives forwarding better than SPF, and it is the check most likely to pass DMARC alignment, because the d= domain is usually your own. Use 2048 bit keys where your provider allows it, turn signing on in the admin console after you publish the key, and keep one key per service so you can rotate one without touching the rest.
The domain email checker looks for DKIM on 25 common selectors, including google, selector1 and selector2. In ZicReach, domain checks show DKIM as Pass, Warning or Missing next to SPF and DMARC for each sending domain, so a mailbox is never warmed on a domain that cannot sign its mail.