---
title: "Stage a DKIM selector rotation"
method: POST
path: "/v1/email/domains/{id}/rotate-dkim"
tags: ["Email"]
---

# Stage a DKIM selector rotation

`POST /v1/email/domains/{id}/rotate-dkim`

## Request

- Base URL: `https://api.samva.dev`
- URL: `https://api.samva.dev/v1/email/domains/{id}/rotate-dkim`
- Auth: API key in header `x-api-key`

Creates a new DKIM signing key and returns its public DKIM record. Publish it, then advance domain verification to switch signing to the new key. Keep the former record published at least until `minimumRetainUntil`.

## Path parameters

- `id` string, required

## Headers

- `idempotency-key` string, required

## Response `200`

EmailDkimRotation

- EmailDkimRotation
  - `id` string, required
  - `domainId` string, required
  - `phase` 'staged' | 'cutover' | 'complete', required
  - `selector` string, required
  - `record` object, required
    - `name` string, required
    - `type` 'TXT', required
    - `value` string, required
    - `ttl` string, required
  - `formerRecord` object, required
    - `name` string, required
    - `type` 'TXT', required
    - `value` string, required
  - `minimumRetainUntil` string, nullable, required: The earliest time the former DKIM record may be removed. Keep it published at least until then so mail signed with the former key still verifies.

## Other responses

- `401`: UnauthorizedError
- `403`: ForbiddenError
- `404`: ResourceNotFoundError
- `409`: ConflictError
- `422`: ValidationError
- `500`: InternalError
- `502`: EmailChannelError
- `504`: GatewayTimeoutError

---

[API](https://skmtc.dev/samva/apis/samva-api.md) · [All operations](https://skmtc.dev/samva/apis/samva-api/llms.txt) · [OpenAPI document](https://skmtc.dev/samva/apis/samva-api/revisions/a99408542cc3?raw)