The pending key becomes active and signs the domain's outgoing mail from now on. The key it replaces turns retiring: it stays in DNS until its retire_after, so mail it already signed still checks out, and is then removed on its own.
Parameters
Name
Where
What it is
domain required
path
The domain.e.g. example.com
selector required
path
The pending key's selector, from List a domain's signing keys.e.g. 20261103a
Good to know
Switch only once the new key's DNS record has had time to spread; until then, receivers can't check mail signed with it.
Only a pending key can be switched to; any other answers 409.
