Sign in
Email Domains

Rotate the DKIM key for an email domain

Generates a new DKIM key for the domain, activates it, and retires the previous key. The response includes the updated DKIM DNS records the customer must publish. Selectors are fixed, so rotation replaces the TXT value at the existing <selector>._domainkey.<domain> host rather than adding a second record — old_selector_retained is false and the new TXT value must be published promptly, since signing switches to the new key immediately and the old TXT value will no longer match. The previous key is retired to a retiring state (retained, not revoked) so it can be revoked after the DNS propagation grace period.

post/email_domains/{domain_id}/rotate_dkim

Path parameters

domain_idstring uuid required

Email domain UUID

Response

DKIM key rotated

Example response

{
  "data": {
    "record_type": "email_domain_dkim_rotation",
    "domain_id": "123e4567-e89b-12d3-a456-426614174002",
    "domain": "example.com",
    "dkim": {
      "id": "123e4567-e89b-12d3-a456-42661417400a",
      "selector": "telnyx1",
      "algorithm": "rsa-sha256",
      "key_length": 2048,
      "version": 2,
      "status": "active",
      "activated_at": "2026-09-11T12:00:00Z"
    },
    "previous_dkim_key": {
      "id": "123e4567-e89b-12d3-a456-426614174009",
      "selector": "telnyx1",
      "version": 1,
      "status": "retiring"
    },
    "old_selector_retained": false,
    "dns_records": [
      {
        "id": "123e4567-e89b-12d3-a456-42661417400b",
        "purpose": "dkim",
        "record_type": "TXT",
        "host": "telnyx1._domainkey.example.com",
        "value": "v=DKIM1; k=rsa; p=MIIBIjANBgkqh...",
        "actual_value": null,
        "priority": null,
        "required": true,
        "status": "pending"
      }
    ]
  }
}

Changes