# Make a new signing key

`POST https://api.mailmasker.org/api/v1/domains/:domain/dkim/rotate`

Create a new DKIM key for a domain and publish it in DNS, ready to switch to.

- Who can use it: Site admins
- Area: DKIM signing keys
- Answers 201 Created when it works
- Page: https://developer.mailmasker.org/dkim-rotate

Makes a new 2048-bit key, its selector named for today's date, such as `20261103a` (`20261103b` for a second one that day), and publishes its public half in DNS, where receivers look it up. It starts out pending and signs nothing until you switch to it.

## Parameters

| Name | In | Required | What it is | Example |
|---|---|---|---|---|
| `domain` | path | yes | The domain. | `example.com` |

## Good to know

- If the key can't be made or its DNS record can't be published, the answer is 502 and nothing is left behind.
- The private half of a key is never shown.

## Examples

cURL:

```bash
curl -s -X POST 'https://api.mailmasker.org/api/v1/domains/example.com/dkim/rotate' \
  -H "Authorization: Bearer $TOKEN"
```

Perl:

```perl
use Mojo::Base -strict;
use Mojo::UserAgent;

my $ua  = Mojo::UserAgent->new;
my $res = $ua->post('https://api.mailmasker.org/api/v1/domains/example.com/dkim/rotate',
    { Authorization => "Bearer $ENV{TOKEN}" })->result;
die $res->code, ' ', ($res->json('/error') // $res->message), "\n" unless $res->is_success;
print $res->body, "\n";
```

homelab-cli:

```bash
homelab-cli dns dkim rotate example.com
```

## Response

201 Created:

```json
{
  "id": 9,
  "domain_id": 3,
  "selector": "20261103a",
  "state": "pending",
  "public_key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...IDAQAB",
  "key_bits": 2048,
  "created_by": "you@example.com",
  "activated_by": null,
  "retired_by": null,
  "created_at": "2026-11-03 21:42:10.123456-06",
  "activated_at": null,
  "retiring_at": null,
  "retire_after": null,
  "retired_at": null,
  "next_action_at": null
}
```