Add and verify a domain

Live email is sent from a domain you own. Verifying it proves that, and lets mailbox providers trust your mail.

In the dashboard, open your live project → Domains → Add domain, or call POST /v1/domains.
Copy the DNS records we show you.
Add them at your DNS provider (the company that hosts your domain’s DNS).
Press Check again. Each record shows whether we can see it yet.

Tip: use a subdomain such as mail.yourdomain.com so your main domain’s mail setup is untouched.

We check your DNS for you and email you the moment the domain verifies, so you can add the records and walk away.

On another provider, add the records by hand as described below.

The records

Record	Required	Why
3 × CNAME (DKIM)	Yes	Proves the mail really comes from you. These are what verification checks.
MX and TXT on a “bounce” subdomain	Recommended	Aligns the return address with your domain, which improves trust. Sending works without it.
TXT at _dmarc	Recommended	Tells receivers what to do with mail that fails authentication, and gives you reports.

Adding records at common providers

Cloudflare: add each CNAME with the proxy off (grey cloud, “DNS only”). Proxied CNAMEs will not verify.
GoDaddy, Namecheap, Squarespace: enter only the part of the name before your domain. If the record is abc._domainkey.mail.acme.com and your domain is acme.com, enter abc._domainkey.mail.
Route 53, Google Cloud DNS, Vercel: enter the full name as shown.
Any provider: if it appends your domain automatically, you will see it doubled (for example …acme.com.acme.com). Remove the extra part.
Paste values exactly. Do not add quotes to CNAME values, and do not add a trailing dot unless your provider asks.

How long it takes

Records usually appear in DNS within minutes, then Amazon SES, our sending provider, confirms them. That second step can take from a few minutes up to 72 hours. The status column shows both: Found means we can see the record in public DNS; Verified on the domain means SES has accepted it.

If all required records show Found but the domain is still waiting, nothing is wrong on your side. We keep checking automatically.

If a record shows a problem

Status	Meaning	Fix
Not found	No such record in public DNS yet.	Check the name, add the record, then wait a few minutes.
Points elsewhere	A record exists but with a different value.	Replace its value with the one we show.
Couldn’t check	The DNS lookup failed.	Press Check again in a minute.

After verification

If a verified domain’s records are later removed, sending from it pauses until you restore them. Keep the records in place.

Domain settings

Deliverability. Open Deliverability on a domain for its last 30 days: delivery, bounce and complaint rates against the limits that pause sending, how its DNS is set up, and what to do next. The same data is at GET /v1/domains/{id}/insights.
Encryption (TLS). By default we try an encrypted connection and fall back if the receiving server cannot. Choose Require encryption and a message fails rather than going out unencrypted. Use it if a contract or policy says all mail must be encrypted.
Return-path. Bounces go to a subdomain of yours, bounce by default (bounce.mail.acme.com). Pick another label when you add the domain, or change it later; you then publish the new Recommended records, and mail keeps sending in the meantime.