# Retire a signing key now

`POST https://api.mailmasker.org/api/v1/domains/:domain/dkim/:selector/retire`

Take an active or retiring key out of use and out of DNS straight away.

- Who can use it: Site admins
- Area: DKIM signing keys
- Answers 200 OK when it works
- Page: https://developer.mailmasker.org/dkim-retire

For a key you think has leaked. It skips the rest of the usual wait: the DNS record and the key go at once, so mail it signed that is still on its way fails its signature check. Normally keys retire on their own, after a newer one is switched to.

## Parameters

| Name | In | Required | What it is | Example |
|---|---|---|---|---|
| `domain` | path | yes | The domain. | `example.com` |
| `selector` | path | yes | The key's selector. | `20261020a` |

## Good to know

- Retiring the active key leaves the domain's mail unsigned until you switch to another.
- A pending key can't be retired (cancel it instead), and neither can a retired one; both answer 409.

## Examples

cURL:

```bash
curl -s -X POST 'https://api.mailmasker.org/api/v1/domains/example.com/dkim/20261020a/retire' \
  -H "Authorization: Bearer $TOKEN"
```

Perl:

```perl
use Mojo::Base -strict;
use Mojo::UserAgent;

my $ua  = Mojo::UserAgent->new;
my $res = $ua->post('https://api.mailmasker.org/api/v1/domains/example.com/dkim/20261020a/retire',
    { Authorization => "Bearer $ENV{TOKEN}" })->result;
die $res->code, ' ', ($res->json('/error') // $res->message), "\n" unless $res->is_success;
print $res->body, "\n";
```

homelab-cli:

```bash
homelab-cli dns dkim retire example.com 20261020a
```

## Response

200 OK:

```json
{ "ok": true }
```