# Switch to a new signing key

`POST https://api.mailmasker.org/api/v1/domains/:domain/dkim/:selector/activate`

Start signing a domain's mail with a pending key, and start retiring the old one.

- Who can use it: Site admins
- Area: DKIM signing keys
- Answers 200 OK when it works
- Page: https://developer.mailmasker.org/dkim-activate

The pending key becomes active and signs the domain's outgoing mail from now on. The key it replaces turns retiring: it stays in DNS until its `retire_after`, so mail it already signed still checks out, and is then removed on its own.

## Parameters

| Name | In | Required | What it is | Example |
|---|---|---|---|---|
| `domain` | path | yes | The domain. | `example.com` |
| `selector` | path | yes | The pending key's selector, from List a domain's signing keys. | `20261103a` |

## Good to know

- Switch only once the new key's DNS record has had time to spread; until then, receivers can't check mail signed with it.
- Only a pending key can be switched to; any other answers 409.

## Examples

cURL:

```bash
curl -s -X POST 'https://api.mailmasker.org/api/v1/domains/example.com/dkim/20261103a/activate' \
  -H "Authorization: Bearer $TOKEN"
```

Perl:

```perl
use Mojo::Base -strict;
use Mojo::UserAgent;

my $ua  = Mojo::UserAgent->new;
my $res = $ua->post('https://api.mailmasker.org/api/v1/domains/example.com/dkim/20261103a/activate',
    { Authorization => "Bearer $ENV{TOKEN}" })->result;
die $res->code, ' ', ($res->json('/error') // $res->message), "\n" unless $res->is_success;
print $res->body, "\n";
```

homelab-cli:

```bash
homelab-cli dns dkim activate example.com 20261103a
```

## Response

200 OK:

```json
{
  "id": 9,
  "domain_id": 3,
  "selector": "20261103a",
  "state": "active",
  "public_key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...IDAQAB",
  "key_bits": 2048,
  "created_by": "you@example.com",
  "activated_by": "you@example.com",
  "retired_by": null,
  "created_at": "2026-11-03 21:42:10.123456-06",
  "activated_at": "2026-11-04 09:15:27.640118-06",
  "retiring_at": null,
  "retire_after": null,
  "retired_at": null,
  "next_action_at": null
}
```