DKIM API

Generate, retrieve, rotate, and deactivate DKIM keys for your domains.

Generate DKIM Key

POST /v1/domains/:id/dkim

Generate a new DKIM key pair for a domain. Returns the key details and the DNS record you need to add.

Request Body

FieldTypeRequiredDescription
selectorstringNoDKIM selector name (default: postscale1)

Example Request

curl -X POST https://api.postscale.io/v1/domains/d_abc123/dkim \
  -H "Authorization: Bearer ps_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "selector": "postscale1"
  }'

Response

{
  "key": {
    "selector": "postscale1",
    "domain": "yourapp.com",
    "public_key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ...",
    "created_at": "2026-01-20T14:00:00Z",
    "active": true
  },
  "dns_record": {
    "type": "TXT",
    "name": "postscale1._domainkey.yourapp.com",
    "value": "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ..."
  },
  "message": "DKIM key generated. Please add the DNS record shown below."
}

Get DKIM Records

GET /v1/domains/:id/dkim

Retrieve all DKIM keys and DNS records for a domain.

Example Request

curl -X GET https://api.postscale.io/v1/domains/d_abc123/dkim \
  -H "Authorization: Bearer ps_live_your_api_key"

Response

{
  "domain": "yourapp.com",
  "keys": [
    {
      "selector": "postscale1",
      "domain": "yourapp.com",
      "public_key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ...",
      "created_at": "2026-01-20T14:00:00Z",
      "active": true
    }
  ],
  "dns_records": [
    {
      "type": "TXT",
      "name": "postscale1._domainkey.yourapp.com",
      "value": "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ..."
    }
  ]
}

Rotate DKIM Key

POST /v1/domains/:id/dkim/rotate

Generate a new DKIM key and deactivate the old one. The old and new selectors must be different.

Request Body

FieldTypeRequiredDescription
old_selectorstringYesSelector of the key to deactivate
new_selectorstringYesSelector for the new key (must differ from old_selector)

Example Request

curl -X POST https://api.postscale.io/v1/domains/d_abc123/dkim/rotate \
  -H "Authorization: Bearer ps_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "old_selector": "postscale1",
    "new_selector": "postscale2"
  }'

Response

{
  "new_key": {
    "selector": "postscale2",
    "domain": "yourapp.com",
    "public_key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ...",
    "created_at": "2026-02-10T09:00:00Z",
    "active": true
  },
  "dns_record": {
    "type": "TXT",
    "name": "postscale2._domainkey.yourapp.com",
    "value": "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ..."
  },
  "message": "DKIM key rotated. Please add the new DNS record and keep the old one for a transition period."
}

Deactivate DKIM Key

DELETE /v1/domains/:id/dkim/:selector

Deactivate a DKIM key by its selector. The key will no longer be used for signing outbound email.

Example Request

curl -X DELETE https://api.postscale.io/v1/domains/d_abc123/dkim/postscale1 \
  -H "Authorization: Bearer ps_live_your_api_key"

Response

{
  "status": "deactivated",
  "message": "DKIM key deactivated. You can remove the DNS record after email delivery completes."
}

DKIM Key Fields

FieldTypeDescription
selectorstringDKIM selector name used in the DNS record
domainstringDomain the key belongs to
public_keystringRSA public key (base64-encoded)
created_atstringISO 8601 timestamp of key creation
activebooleanWhether the key is currently active for signing

DNS Record Fields

FieldTypeDescription
typestringDNS record type (always TXT)
namestringFull DNS record name (<selector>._domainkey.<domain>)
valuestringDNS record value containing the DKIM public key
DKIM key rotation best practices

Rotate your DKIM keys every 6-12 months to maintain strong email security. When rotating, publish the new DNS record first and keep the old record in place for at least 48 hours to allow in-flight emails signed with the old key to be verified. Only remove the old DNS record once you are confident all pending deliveries have completed.