Third party email vendors and DKIM

andydavid1 

This is correct, we do it constantly.  We created a subdomain off our main domain to keep things organized like  email.yourdomain.com. This does not affect the header from value on the message which would stay as yourdomain.com. (alignment for dmarc compliance).  Each vendor would be given their own selector value. s=vendor1 vendor2... etc by you.  It has to be unique for each vendor but is an arbitrary value you can make up.

When THE VENDOR generates the dkim key, THE VENDOR would specify the values you give them: s=vendor1 d=email.yourdomain.com.

the dns record you create in your dns becomes vendor1._domainkey.email.yourdomain.com.  You would then take the dkim key that they generate and then sent back to you and import it into your domain record in your dns.  When the message are sent from the vendor, the dkim key contains the s=value d=value you told them to use when they generate the key.  The recipient of the email looks up the value after the d= to get to the doman and the the txt record using the s= value.  The key pairs are verified and the mail is accepted.

**Note you can simplify the management of the dkim key by letting the vendor host the key in their own dns instead of you hosting it in your dns.  You would get from the Vendor the cname value of where they are storing the key in their dns, then you would add that as a cname to your dns record as a cname instead of the key.  I would recommend the second scenario if possible. 

Thats what SPF macros are for Michael Wehking .

But really you arent hostage to that limit. The RFCs allow multiple strings in the SPF record 

Example:

https://kb.isc.org/docs/aa-00356