No DKIM selector shown for domain in Diagnostics

Problem:     

In the Diagnostics > Domain report, the DKIM key column has an empty red circle. You either know that there are valid keys signing for this domain, or you can see that the next column over indicates some level of messages passing DMARC-DKIM. So why doesn't the portal show the relevant selector(s)?

Answer:

None of the major DMARC providers convey selector information in the RUA data, but they do convey DKIM pass/fail information, from which we can deduce any shown percentage.

In order for us to display selector information, we must scrape forensic RUF data to find examples containing selectors. If you click on the empty red circle, you can see information explaining this: "No DKIM keys found in Agari sample data. There may be valid DKIM keys for this domain that have not appeared in a recent DMARC failure sample."

A further implication of this is that if your domain's DMARC record is configured to not send RUF data, the Diagnostic view is likely to show DKIM pass percentages, but never have information about relevant selectors.