DKIM selector monitoring limitations

[mbainter]

The current DKIM check in the email security policy allows you to set a property with a list of DKIM selectors. This is a good initial version, and should provide adequate support for simple setups.

However, a lot of organizations have multiple sending domains, with varying DKIM keys, and in some organizations, those keys are identified by the date they were created for ease of tracking, rotation, etc. This could potentially result in overlapping selectors across multiple domains.

That means, if say, I want to ensure that we only have a particular DKIM selector for domain X.domain.com, and not Y.domain.com I can't assert that in my policy without having them in separate spaces (or, of course, writing my own custom policy.) If I remove a key, I might also be removing a selector from monitoring that's still being used.

I would propose making this a map (if properties support those) of domains => [valid selectors].