Two reliable routes. Read it from your mail provider's DKIM setup page, where it appears alongside the record you were asked to publish. Or take it from a message the domain has already sent: open the raw source, find the DKIM-Signature header, and read the s= tag.
The d= tag next to it is worth checking too. It names the domain that actually did the signing, and mail sent through a platform is sometimes signed by the platform rather than by you — which affects whether DMARC alignment passes.
Several selectors is usually healthy
Finding more than one valid key is normally a good sign rather than a suspicious one. Rotating a DKIM key means publishing a new selector, moving signing across to it, and only then retiring the old one — mail signed before the switch still needs the old key to verify while it is in transit. A period with two live selectors is the correct way to do it.
DKIM proves a message was not altered and came from an authorised signer. To check which hosts may send as the domain, use the SPF checker. To see which hosts receive its mail, use the MX lookup.