Sending domains

Before you can send email, you must add and verify a domain you own. Zend signs every message from that domain with DKIM and checks SPF alignment, which is what lets mailbox providers trust your mail.

You can only send from an address on a domain that is verified and owned by your account. Domains are managed from the dashboard under Email → Domains.

Add a sending domain

Add your domain in the dashboard under Email → Domains. Zend generates the DKIM and SPF records you need to publish at your DNS provider and shows them alongside the domain's verification status.

Note

Use a domain (or subdomain) you control the DNS for — for example mail.yourdomain.com. A dedicated subdomain keeps your sending reputation isolated from your other mail.

DNS setup

Add the records Zend gives you at your DNS provider. A new domain needs three records, plus one we recommend:

  • DKIM — a single TXT record carrying your public signing key, so receivers can verify Zend's signature on every message. (This replaces the three CNAME records we used previously — see the note below.)
  • MX and SPF on a return-path subdomain — these route bounces and authorize Zend's SES-backed infrastructure to send on your behalf.
  • DMARC — recommended: a short policy record that ties SPF and DKIM together and reports who is sending as your domain.

The exact record values are shown per-domain in the dashboard. A typical setup looks like this:

# DKIM (TXT) — one record; the value is your unique public key
zdkim1a2b3c._domainkey.yourdomain.com   TXT   "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."

# Return-path — bounces (MX) and SPF (TXT), on a subdomain
bounce.yourdomain.com   MX    10 feedback-smtp.us-east-1.amazonses.com
bounce.yourdomain.com   TXT   "v=spf1 include:amazonses.com ~all"

# DMARC (TXT) — recommended
_dmarc.yourdomain.com   TXT   "v=DMARC1; p=none;"

Note

Domains verified before September 2026 use the older DKIM setup — three CNAME records instead of the single TXT above. They keep working unchanged; there is nothing to migrate.

DKIM/SPF verification

Once the records propagate, return to Email → Domains and click Verify. Zend checks that the DKIM and SPF records resolve correctly and marks the domain as verified.

DNS changes can take anywhere from a few minutes to a few hours to propagate. Until the domain is verified, any POST /email/send request using a from address on that domain is rejected.

After a domain is verified you can send from any address on it. Head to Send Email to make your first request, and see Deliverability to track how your mail performs.

PreviousOverviewNext Deliverability