Skip to main content
Sequenzy domain details with callouts showing sender profiles and DNS records
Setting up a custom domain ensures your emails reach inboxes and aren’t flagged as spam. Sequenzy shows the exact records required for your domain. Publish every record in that table: newer domains use a unified Sequenzy record set, while existing domains keep their legacy Amazon SES record set.
You can start sending emails immediately using the built-in sequenzymail.com domain without any DNS setup. However, this shared domain has shared reputation across all users, so emails may land in spam. For best deliverability, set up a custom domain.

​
Why Domain Verification Matters

When you send an email, receiving mail servers (Gmail, Outlook, etc.) check if the email is legitimate. Without a verified custom domain, your emails may:
  • Land in spam folders
  • Be rejected entirely
  • Damage your sending reputation
Domain verification proves:
  1. You own the domain - Only someone with DNS access can add the required records
  2. You authorize Sequenzy to send on your behalf - The records authorize Sequenzy’s sending infrastructure or, for a legacy domain, Amazon SES
It does not move your mailbox hosting to Sequenzy. The required DKIM and return-path records do not replace the normal MX records that receive mail for yourdomain.com, so a mailbox hosted by Hostinger, Google Workspace, or another provider can keep receiving mail.
After verification, an address or alias on the domain can be the visible From address. Any valid external mailbox can also be Reply-To. Sequenzy still performs outbound delivery through SES or Sequenzy’s MTA; customer-managed SMTP relays are not supported.

​
How Email Authentication Works

Email authentication uses multiple protocols working together. When a receiving server gets your email:
  1. SPF Check - “Is this server allowed to send for this domain?” → Looks up TXT record on bounce subdomain
  2. DKIM Check - “Was this email modified in transit?” → Verifies cryptographic signature using public key from TXT record
DMARC is an additional layer that tells receiving servers what to do when authentication fails. It is required for domains created with the unified record set and remains advisory for existing legacy domains.

​
Required DNS Records

Sequenzy shows the required DNS records for your domain during setup. The values in the dashboard and API are authoritative; the examples below explain the two supported record shapes.

​
DKIM Record

DKIM adds a digital signature to every email. Sequenzy generates a unique key pair for your domain: outgoing emails are signed with the private key, and receiving servers verify using the public key. New domains publish a CNAME to the key, which Sequenzy hosts (see below). Domains added earlier publish the key itself:

​
Record Set for New Domains

New domains publish CNAMEs that point at records Sequenzy hosts for that one domain (<id> below is a short random ID shown in your dashboard). You add them once: Sequenzy can then change keys and sending infrastructure without you editing DNS again. Set every CNAME to DNS only on Cloudflare. A CNAME can’t share its name with other records, so remove any other records at those names first.
  • sq1 carries your DKIM key (2048-bit). It is required.
  • sq2 is a spare DKIM selector. It lets Sequenzy change your DKIM key without a DNS change from you. It never blocks verification.
  • rp is the return path (where bounces go) for one part of your sending. Sequenzy checks SPF and MX at rp through it, so it works even when your DNS host blocks custom MX records, for example Namecheap while email forwarding is on.
  • rp2 is the return path for the rest of your sending. With it, SPF aligns with your domain on every email, which DMARC reports and deliverability audits check. It is recommended and never blocks verification or sending: without it, those emails still pass DMARC through DKIM.

​
Earlier Record Sets

Domains added before the CNAME record set keep the records they published, and keep working as they are: Domains added before the single send CNAME publish these two records at the same name instead: rp is the default return-path subdomain. Domains added earlier keep their names: send (some with bounces), or rp with srp. Under Advanced options when you add a domain, or with mailFromPrefix in the API, you can choose another one, for example mail; the second record is then usually mail2. Always publish the names Sequenzy shows you. It is set once, when the domain is added. Recipients can see these names in email headers. The links CNAME is your company tracking domain, which every sending domain shares (see Custom Tracking Domains). It is listed with the first domain you add, on that domain’s root, and it is optional: the domain verifies and sends without it. Once it works, later domains show it as already set up. The DMARC record may already exist at your organizational domain. Do not create a second DMARC record: publish or keep one valid v=DMARC1 record. Sequenzy checks the sending domain first and then its organizational domain.
Sequenzy sends through more than one sending infrastructure, and no customer DNS change is needed when a domain moves between them. Each uses its own return path: rp for one, rp2 for the other. Domains without an rp2 record still pass DMARC through DKIM on every email.

​
Upgrade to the current records

We’ve upgraded our DNS structure. A verified domain on these records, or on the legacy SES record set below, can move to the record set for new domains without being removed. The upgrade is optional and needed only once, and we recommend it: it improves deliverability and security. It is being offered to domains gradually. The domain keeps sending on its current records while the upgrade is in progress, and sender profiles, sequences and tracking stay as they are. website.dnsUpgrade.status is available when a domain can. A domain on the legacy SES record set needs a working DMARC record before it can start; without one, starting returns 400 with “Add a DMARC record for this domain before upgrading its DNS records.” and the status is unavailable. Add one (see DMARC Requirement), then try again. Domains that use Amazon’s three-CNAME DKIM records, and domains in the middle of an earlier records migration, can’t be upgraded yet.
  1. Start the upgrade from your domain’s page in Settings → Domain, with sequenzy websites upgrade-dns yourdomain.com, the MCP tool upgrade_sending_domain_dns or the API.
  2. Add the four CNAMEs it returns (sq1._domainkey, sq2._domainkey, rp and rp2 by default) next to your current records. Remove nothing yet. If rp is taken or already has DNS records, the return path uses rp1, then sqrp.
  3. About an hour after the DKIM (sq1._domainkey) and return path CNAMEs are visible on public DNS (Google and Cloudflare resolvers), the domain switches by itself. The wait lets any cached “does not exist” answers expire. Verifying the domain checks right away but does not skip the wait. Sequenzy prepares the domain’s sending setup separately and switches only once it is confirmed, so sending is normally not interrupted and no emails are held. If that isn’t possible for a domain, emails sent through Amazon SES can be held for a few minutes while SES confirms the new setup, then they go out. The domain also gets a new 2048-bit DKIM key; you still add the same four CNAMEs.
  4. Optionally, delete the old records 8 days after the switch; keeping them does no harm. They are the DKIM TXT at sequenzy._domainkey and the old return path, usually send. For a domain on the legacy SES record set, that is the MX and TXT at send.yourdomain.com and the DKIM TXT; keep your DMARC record. website.dnsUpgrade.oldRecords lists them with the date and marks each one removed once it is gone; before the switch replacedRecords lists them. They are kept a week because emails sent just before the switch can still be delivered, retried or bounced for a few days, and those emails rely on the old records.
Once started, an upgrade can’t be cancelled. Until the switch it changes nothing: the domain keeps sending on its current records.

​
Legacy SES Record Set

Existing domains are not migrated automatically. Their dashboard may continue to show: Some older domains also list an MX record at inbound.yourdomain.com for branded replies. That setup now appears as a receiving domain; keep the record so it keeps receiving. Region-specific Amazon endpoints can differ from these examples, so always use the stored value Sequenzy returns.

​
DMARC Requirement

DMARC is required for the unified record cohort and advisory for legacy SES domains, except that a legacy SES domain needs a working DMARC record to upgrade to the current records. Any single valid DMARC policy passes the unified-domain gate; Sequenzy suggests v=DMARC1; p=none; as a safe starting point but does not force a particular p= policy.

Implementing DMARC

Learn how to set up DMARC for your domain with step-by-step instructions

​
Verification Methods

Sequenzy domain dialog with callouts showing domain entry and subdomain guidance

​
Option 1: Automatic Setup with Domain Connect

If your DNS provider supports Domain Connect, you can set up supported record sets from Sequenzy without copying values into your DNS dashboard manually. Unified domains currently use manual setup or Cloudflare direct setup so the required DMARC and Sequenzy MX/SPF values cannot be omitted by an older Domain Connect template. Step 1: Start automatic setup
  1. Go to Settings → Domain and click your domain
  2. On the setup page, choose Add Automatically. For Cloudflare, choose Sign in to Cloudflare. If neither is offered, use manual setup below.
  3. Sign in to your DNS provider if prompted
  4. Review and approve the DNS changes
Sequenzy uses Domain Connect discovery to detect DNS providers that expose the standard _domainconnect record and support Sequenzy’s template. Step 2: Return to Sequenzy After your DNS provider applies the records, it redirects you back to Sequenzy. Verification starts automatically and can still take a few minutes while DNS and the configured sending provider finish processing the changes.
Domain Connect does not give Sequenzy permanent access to your DNS account. The provider approval page applies only the records shown for this setup.

​
Custom Tracking Domains

Your company tracking domain gives tracked clicks and open pixels your branded host, for example links.yourdomain.com. Every sending domain uses it, so you add one CNAME once. It is available on every plan, including the free plan.
  • Any subdomain you control works, even on a root you do not send from. A bare domain such as yourdomain.com cannot hold a CNAME, so use a subdomain.
  • Manage it in Settings → Tracking, or with the Tracking Domain API.
  • It never blocks sending. Until it verifies, and whenever its record is broken or removed, links use Sequenzy’s shared tracking domain. Brief DNS outages are ignored; a verified domain has to fail for at least 30 minutes before links move.
  • If a tracking domain that was working stops working, the dashboard shows an alert until you fix it.
  • Changing to another tracking domain keeps links in emails you already sent working, as long as you keep the old CNAME record. Removing it breaks them.

​
Receiving Domains

A sending domain does not receive mail. To receive replies and other mail on your own domain, add a receiving domain in Settings → Inbox, such as support.yourdomain.com. It needs an MX record, and a TXT record when Amazon SES needs proof that you own the name. A workspace has one receiving domain. Once it is verified, trackable reply-to addresses for emails from all your sending domains use it, for example reply+id@support.yourdomain.com, and the Inbox turns on. Mail for a domain goes wherever its MX records point, so Sequenzy won’t add a domain that already receives email with another provider, such as Google Workspace. Use a subdomain instead. See Inbox.

​
Landing Page Domains

Landing page custom domains use a CNAME record so published landing pages can serve from your branded host, for example pages.yourdomain.com. If your DNS provider supports Domain Connect and the Sequenzy landing-page template, the Landing Pages workspace shows an automatic setup button for this CNAME. If Vercel requires an ownership verification TXT record, Sequenzy uses a second Domain Connect template that includes both records.

​
Option 2: Manual DNS Setup

  1. Go to Settings → Domain and click your domain
  2. Copy each DNS record from the verification table
  3. Add them in your DNS provider’s control panel
  4. Return to Sequenzy and click I’ve added the records
Common DNS Providers:
HostGator has two DNS editors, and only one of them is live. If your domain uses nsXXXX.hostgator.com hosting nameservers, records added under Domains → your domain → DNS in the customer portal are never published. Use Hosting → Launch cPanel → Zone Editor instead. See Records saved but never detected below.
DNS propagation can take up to 48 hours, though most records propagate within 15-30 minutes.

​
Verification Process

Once you’ve confirmed the DNS records were added, Sequenzy monitors their status:
  1. DNS Lookup - Checks if records exist and point to correct values
  2. Home Transport Activation - Sequenzy confirms the selected SES region or MTA route can accept mail
  3. DMARC Check - Required for unified domains and advisory for legacy domains
  4. Inbound Routing - When an inbound reply MX is present, Sequenzy connects the receipt rule for branded reply tracking
  5. Status Update - DNS and sending readiness update independently

​
Verification Statuses

The dashboard exposes three related states:
  • DNS - Not started, pending, verified, misconfigured, or failed.
  • Sending - Activating or ready to send. Ready requires verified DNS plus the selected home transport.
  • SES region - the selected AWS region whose identity must be ready.
A newly DNS-verified domain can briefly show Activating SES while AWS makes the home-region identity sendable. Sequenzy retries automatically and does not allow sends during that window. The domain becomes Ready to send as soon as the selected home transport is ready. A DNS-verified domain is never demoted because of a temporary DNS hiccup: a status only changes after repeated, confirmed checks. While Sequenzy double-checks an inconsistent answer, the domain shows a “Rechecking DNS records” hint and keeps sending. If a verified domain does lose verification, the dashboard shows exactly which record is missing or wrong so you can fix it, and the domain returns to verified automatically on the next successful check.

​
Troubleshooting

​
Records Not Detected

  • Wait for propagation - DNS changes can take up to 48 hours
  • Check for typos - Ensure record names and values match exactly
  • Check proxy settings - For Cloudflare, DKIM records must have proxy disabled (DNS only)

​
Records Saved but Never Detected (Wrong DNS Editor)

If you added the records, they show in your provider’s dashboard, but verification keeps reporting them as missing even after hours, you are probably editing a DNS zone that your domain does not actually use. Some providers keep two separate copies of your DNS: one attached to the domain registration and one attached to the hosting account. Only the copy served by your domain’s active nameservers is live - changes to the other copy are saved but never published. How to check which zone is live:
  1. Find your domain’s nameservers (in your provider’s dashboard, or run dig NS yourdomain.com)
  2. Make sure the DNS editor you are using belongs to the account or product those nameservers point to
  3. After saving a record, verify it resolves publicly:
If this returns nothing several minutes after saving, the record is not being published - you are editing the wrong zone, not waiting on propagation. HostGator specifically: HostGator shows a DNS editor in two places, and only one is live depending on your nameservers:
  • If your domain uses hosting nameservers such as ns8153.hostgator.com (the default when you have a HostGator hosting plan), DNS is served from your hosting account. Add records via Hosting → Launch cPanel → Zone Editor → Manage next to your domain. TXT records are added from the Add Record dropdown on the Manage page.
  • The Domains → your domain → DNS tab in the HostGator customer portal edits a registrar-side zone. When the domain points at hosting nameservers, records saved there are never published, even though the dashboard shows them as saved.
cPanel refuses to save with a CNAME error: cPanel validates the entire zone on save. If you see an error like Only 1 "CNAME" record may exist per name for a record you did not touch (often cpanel.yourdomain.com or webmail.yourdomain.com), the zone contains pre-existing duplicate records that block all changes. Filter the record list for that name, delete the duplicate CNAME row, then save your new records again.

​
Verification Is Stuck

If verification stays pending or misconfigured:
  1. Delete the domain in Sequenzy
  2. Re-add it to get a fresh DKIM key
  3. Update your DNS records with the new values

​
Receiving Domain Not Verified

If a receiving domain stays pending or failed:
  1. Read the error shown on it in Settings → Inbox. It says what to fix
  2. Confirm the MX record points to the inbound-smtp endpoint shown in Sequenzy and that no other MX records share the name
  3. Publish the TXT record when one is listed, then check the domain again
Until it is verified, replies use inbound.sequenzy.com, so nothing is lost.

​
Cloudflare Token Errors

​
Using Subdomains

We strongly recommend sending from a subdomain (e.g., mail.example.com) rather than your root domain. This protects your domain reputation and isolates any deliverability issues.

Why Use Subdomains?

Learn about reputation isolation, risk prevention, and best practices for subdomain email sending

​
Best Practices

  1. Use a subdomain - Protect your root domain’s reputation with mail.yourdomain.com
  2. Keep one valid DMARC record - It is required for unified domains and protects legacy domains against spoofing
  3. Keep tokens secure - Never share your Cloudflare API token publicly
  4. Receive on a subdomain - Use a receiving domain such as support.yourdomain.com so your existing mailboxes keep their mail

Using Subdomains

Protect your domain reputation

Implementing DMARC

Set up DMARC for your domain

Quick Start

Get started sending emails

Transactional Emails

Send triggered emails via API