DKIM signing keys
Retire a signing key now
POST/api/v1/domains/:domain/dkim/:selector/retire
Who can use this: Site adminsAs Markdown
For a key you think has leaked. It skips the rest of the usual wait: the DNS record and the key go at once, so mail it signed that is still on its way fails its signature check. Normally keys retire on their own, after a newer one is switched to.
Parameters
| Name | Where | What it is |
|---|---|---|
| domain required | path | The domain.e.g. example.com |
| selector required | path | The key's selector.e.g. 20261020a |
Good to know
- Retiring the active key leaves the domain's mail unsigned until you switch to another.
- A pending key can't be retired (cancel it instead), and neither can a retired one; both answer 409.