The sending server signs selected headers and the body with a private key and adds a DKIM-Signature header. The header names the signing domain (d=) and a selector (s=). The receiver fetches the public key from the TXT record at selector._domainkey.domain and verifies the signature.
Selectors allow several keys to exist at once: one per sending service, or an old and a new key during rotation. This also means DKIM cannot be discovered from the domain name alone. A tool can only check a DKIM record if it knows the selector, which is found in the DKIM-Signature header of a real message.
Unlike SPF, a DKIM signature usually survives forwarding, because it travels with the message. It breaks when an intermediary, typically a mailing list, changes the subject or body. Keys of 2048 bits are the sensible choice today. By itself DKIM does not tell receivers what to do with unsigned mail; DMARC provides that policy.
Example
sel1._domainkey.example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=<public key>"
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=sel1; h=from:to:subject; bh=...; b=...