Verify a domain
Add the DNS records that let you send email from your domain.
You can only send from domains you have verified. Verifying proves you control the domain and sets up the authentication (DKIM, SPF and DMARC) that mailbox providers check.
Add the domain
Add it in the dashboard under Domains, or with the API:
curl -X POST https://api.usend.et/domains \
-H "Authorization: Bearer us_123456789" \
-H "Content-Type: application/json" \
-d '{ "name": "acme.com" }'You can verify the root domain (acme.com) or a subdomain (mail.acme.com). Once a domain is verified, you can also send from its subdomains. A domain can be verified by only one usend organization at a time.
Publish the DNS records
The response, and the domain's page in the dashboard, list the records to add at your DNS host. Names are relative to your domain: rs1._domainkey means rs1._domainkey.acme.com, and @ means the domain itself.
| Record | Name | Type | Value | Required |
|---|---|---|---|---|
| DKIM | rs1._domainkey | TXT | v=DKIM1; k=rsa; p=MIIB... | Yes |
| Return path (SPF) | send-ses | CNAME | rp-ses-us-east-1.usend.et | Yes |
| DMARC | _dmarc | TXT | v=DMARC1; p=none; | Recommended |
| Receiving | @ | MX | inbound-smtp.us-east-1.amazonaws.com (priority 10) | Only when receiving is enabled |
Always copy the values from the dashboard or the API: the DKIM key is unique to your domain.
DKIM
The DKIM record publishes the public half of a 2048-bit key generated for your domain. Every email you send is signed with it, so receivers can check that the message really comes from your domain and was not changed in transit. The signature uses your domain, which is what makes DMARC pass.
Return path
Every email has a hidden envelope sender, the return path, where bounces go. usend uses send-ses.acme.com for this. The CNAME points it at usend, which carries the MX and SPF records for it. That way:
- SPF passes for your subdomain, aligned with your domain for DMARC.
- Bounces and complaints come back to usend, which records them for you.
If your DNS host is Cloudflare, set the CNAME to DNS only (grey cloud), not proxied. A proxied CNAME hides the MX and TXT records usend needs, and verification will not pass.
You can use a different name than send for the return path. See Custom return path.
DMARC
DMARC is not required to verify the domain, but mailbox providers such as Gmail and Yahoo expect it from bulk senders. See DMARC.
Faster setup
- Auto-configure: if your DNS is hosted on Cloudflare, usend can publish the records for you. See Auto-configure with Cloudflare.
- Zone file: the domain's page has a Zone file button that downloads the records in BIND format, for DNS hosts that can import zone files.
Start verification
After publishing the records, click Verify in the dashboard or call:
curl -X POST https://api.usend.et/domains/d91cd9bd-1176-453e-8fc1-35364d380206/verify \
-H "Authorization: Bearer us_123456789"Verification runs in the background. Poll GET /domains/{id} or watch the dashboard. Each record in records has its own status:
| Record status | Meaning |
|---|---|
not_started | Not checked yet. |
pending | Not found in DNS yet. |
verified | Found with the right value. |
failed | Found, but with a different value. |
DNS changes can take from a few minutes to a few hours to propagate. usend checks with public resolvers, so it sees what other mail servers see.
Domain status
| Status | Meaning |
|---|---|
not_started | Added, verification not started yet. |
pending | Waiting for the records. usend re-checks every few minutes. |
verified | DKIM and the return path verified. You can send. |
temporary_failure | DNS lookups failed temporarily. usend keeps trying. |
failed | The records were not found within 72 hours, or another organization already verified this domain. |
A domain is verified when its DKIM and return-path records verify (on usend.et, Amazon SES must also confirm the domain, which usually takes a few minutes after DNS is in place). DMARC and the receiving MX are not required.
If a domain fails, fix the records and click Verify again to restart the 72-hour window.
After verification
usend keeps checking verified domains once a day, and every hour while an optional record (DMARC, receiving MX) is still missing, so fixes show up quickly.
If the records of a verified domain disappear, the domain stays verified for 72 hours while usend keeps checking. A typo or a DNS migration in progress does not stop your email. If the records are still missing after 72 hours, the domain becomes failed and sending from it stops.
Delete a domain
DELETE /domains/{id} removes the domain. You can no longer send from it. Remove its DNS records afterwards if you no longer need them.
See the Domains API reference.