DKIM Key Rotation

Each domain has one DKIM key (selector mlnd, RSA-2048), created automatically when you add the domain.

Rotating or deactivating a DKIM key is temporarily unavailable: POST /v1/domains/{id}/dkim/{keyId}/rotate and DELETE /v1/domains/{id}/dkim/{keyId} both return 409 CONFLICT. Your existing key is unchanged either way. If you suspect a key is compromised, contact support: this is an Owner-authorized incident workflow, not a self-service endpoint.

List DKIM Keys

View the DKIM key(s) for a domain:

GET https://api.mail.land/v1/domains/{id}/dkim

Authenticate with Authorization: Bearer <token> or X-API-Key: <api key>.

List DKIM keys

curl https://api.mail.land/v1/domains/k3v9x2m8q1w7z4/dkim \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."

DKIM keys response

[
  {
    "id": "d7f2k9m1x3w8z",
    "domainId": "k3v9x2m8q1w7z4",
    "domain": "yourdomain.com",
    "selector": "mlnd",
    "publicKey": "MIIBIjANBgkqhkiG9w0BAQE...",
    "keyType": "rsa",
    "isActive": true,
    "createdAt": "2026-02-17T10:00:00Z",
    "rotatedAt": null,
    "dnsRecordValue": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQE...",
    "dnsRecordHost": "mlnd._domainkey.yourdomain.com"
  }
]

Field	Type	Description
`id`	string	Key public ID
`domainId`	string	Associated domain's public ID
`domain`	string	Domain name
`selector`	string	DKIM selector: always `mlnd` today
`publicKey`	string	Public key (Base64)
`keyType`	enum	`rsa`
`isActive`	boolean	Whether this key is currently active
`createdAt`	datetime	When the key was created
`rotatedAt`	datetime	When the key was last rotated (currently always `null`, rotation is unavailable)
`dnsRecordValue`	string	Full DNS TXT record value
`dnsRecordHost`	string	DNS hostname where the record should be added: `{selector}._domainkey.{domain}`

Generate a DKIM Key

POST https://api.mail.land/v1/domains/{id}/dkim/generate

This only succeeds for a domain that has no DKIM key at all. Every domain gets one automatically when it is added, so calling this on a normal domain returns 409 CONFLICT. It exists to recover a domain that somehow has none.

On success (201 Created), the response shape is:

Generate response (only when the domain has no key)

{
  "key": {
    "id": "d7f2k9m1x3w8z",
    "domainId": "k3v9x2m8q1w7z4",
    "domain": "yourdomain.com",
    "selector": "mlnd",
    "publicKey": "MIIBIjANBgkqhkiG9w0BAQE...",
    "keyType": "rsa",
    "isActive": true,
    "createdAt": "2026-02-17T10:00:00Z",
    "rotatedAt": null,
    "dnsRecordValue": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQE...",
    "dnsRecordHost": "mlnd._domainkey.yourdomain.com"
  },
  "dnsInstructions": {
    "recordType": "TXT",
    "hostName": "mlnd._domainkey.yourdomain.com",
    "value": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQE...",
    "instructions": "Add a TXT record with hostname 'mlnd._domainkey' and the value shown above. DNS propagation may take up to 48 hours."
  },
  "message": "DKIM key generated successfully. Please add the DNS record and verify your domain."
}

Rotating or Deactivating a Key

POST /v1/domains/{id}/dkim/{keyId}/rotate and DELETE /v1/domains/{id}/dkim/{keyId} both return 409 CONFLICT today (UNG-127 containment, pending DNS-verified signer switching). Neither call changes your key, your DNS state, or Redis/cache: nothing is revoked and nothing stops sending.

If you suspect a DKIM key has been compromised, contact support. This is an Owner-authorized incident workflow: it is not exposed through these endpoints.

Error Responses

Status	Code	Description
`409`	`CONFLICT`	Rotate/deactivate: temporarily unavailable. Generate: the domain already has a key.
`404`	`RESOURCE_NOT_FOUND`	"DKIM key not found": the key ID does not exist for this domain
`404`	`DOMAIN_NOT_FOUND`	Domain does not exist

Next Steps

Verification: verify domain ownership after adding DNS records
DNS Setup: review all required DNS records
REST API: send email with your verified domain

DKIM Key Rotation

List DKIM KeysCopy Anchor Link

Generate a DKIM KeyCopy Anchor Link

Rotating or Deactivating a KeyCopy Anchor Link

Error ResponsesCopy Anchor Link

Next StepsCopy Anchor Link

On this page

List DKIM Keys

Generate a DKIM Key

Rotating or Deactivating a Key

Error Responses

Next Steps