What is DKIM?
DKIM signs selected message headers and publishes its public key in DNS.
Keys and selector
The sender keeps the private key. Receivers fetch the public key at selector._domainkey.example.com. s= is the selector and d= is the signing domain.
What a signature proves
A receiver can validate selected headers and the body hash after delivery. Rotate keys by publishing a new selector before retiring the old one.
DKIM and DMARC
DKIM PASS does not automatically protect visible From: a service can sign with its own d= domain. DMARC needs alignment.