# List a domain's signing keys

`GET https://api.mailmasker.org/api/v1/domains/:domain/dkim/selectors`

Every DKIM key a domain has had, by selector, newest first, with its state.

- Who can use it: Site admins
- Area: DKIM signing keys
- Answers 200 OK when it works
- Page: https://developer.mailmasker.org/dkim-list

A key's `state` is pending (published in DNS, not signing yet), active (signing the domain's mail; there is at most one), retiring (replaced, but kept in DNS until `retire_after` so mail it already signed still checks out) or retired (gone from DNS).

## Parameters

| Name | In | Required | What it is | Example |
|---|---|---|---|---|
| `domain` | path | yes | The domain. | `example.com` |

## Good to know

- A domain that isn't on the system answers 404.

## Examples

cURL:

```bash
curl -s 'https://api.mailmasker.org/api/v1/domains/example.com/dkim/selectors' \
  -H "Authorization: Bearer $TOKEN"
```

Perl:

```perl
use Mojo::Base -strict;
use Mojo::UserAgent;

my $ua  = Mojo::UserAgent->new;
my $res = $ua->get('https://api.mailmasker.org/api/v1/domains/example.com/dkim/selectors',
    { Authorization => "Bearer $ENV{TOKEN}" })->result;
die $res->code, ' ', ($res->json('/error') // $res->message), "\n" unless $res->is_success;
print $res->body, "\n";
```

homelab-cli:

```bash
homelab-cli dns dkim list example.com
```

## Response

200 OK:

```json
[
  {
    "id": 9,
    "selector": "20261103a",
    "state": "pending",
    "key_bits": 2048,
    "created_at": "2026-11-03 21:42:10.123456-06",
    "activated_at": null,
    "retiring_at": null,
    "retire_after": null,
    "retired_at": null
  },
  {
    "id": 7,
    "selector": "20261020a",
    "state": "active",
    "key_bits": 2048,
    "created_at": "2026-10-20 10:02:44.318200-05",
    "activated_at": "2026-10-20 14:30:05.771032-05",
    "retiring_at": null,
    "retire_after": null,
    "retired_at": null
  }
]
```