> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sequenzy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Domain Verification

> Set up your sending domain with DNS records for maximum email deliverability

# Domain Verification

Setting up a custom domain ensures your emails reach inboxes and aren't flagged as spam. New custom domains include **4 DNS records** for sending authentication, bounce tracking, and branded reply routing.

<Note>
  You can start sending emails immediately using the built-in `sequenzymail.com`
  domain without any DNS setup. However, this shared domain has shared
  reputation across all users, so emails may land in spam. For best
  deliverability, set up a custom domain.
</Note>

## Why Domain Verification Matters

When you send an email, receiving mail servers (Gmail, Outlook, etc.) check if the email is legitimate. Without a verified custom domain, your emails may:

* Land in spam folders
* Be rejected entirely
* Damage your sending reputation

Domain verification proves:

1. **You own the domain** - Only someone with DNS access can add the required records
2. **You authorize Sequenzy to send on your behalf** - The records explicitly list Amazon SES as an authorized sender

It does not move your mailbox hosting to Sequenzy. The required DKIM,
`send.yourdomain.com`, and `inbound.yourdomain.com` records do not replace the
normal MX records that receive mail for `yourdomain.com`, so a mailbox hosted by
Hostinger, Google Workspace, or another provider can keep receiving mail.

<Note>
  After verification, an address or alias on the domain can be the visible From
  address. Any valid external mailbox can also be Reply-To. Sequenzy still
  performs outbound delivery through SES or Sequenzy's MTA; customer-managed
  SMTP relays are not supported.
</Note>

## How Email Authentication Works

Email authentication uses multiple protocols working together. When a receiving server gets your email:

1. **SPF Check** - "Is this server allowed to send for this domain?" → Looks up TXT record on bounce subdomain
2. **DKIM Check** - "Was this email modified in transit?" → Verifies cryptographic signature using public key from TXT record

<Note>
  DMARC is an additional layer that tells receiving servers what to do when
  authentication fails. While recommended for domain protection, it's **not
  required** for domain verification in Sequenzy.
</Note>

## Required DNS Records

Sequenzy shows the required DNS records for your domain during setup:

### DKIM Record (1 TXT record)

DKIM adds a digital signature to every email. Sequenzy generates a unique key pair for your domain — outgoing emails are signed with the private key, and receiving servers verify using the public key published in this record.

| Type | Name                                 | Value                           |
| ---- | ------------------------------------ | ------------------------------- |
| TXT  | `sequenzy._domainkey.yourdomain.com` | `v=DKIM1; k=rsa; p={base64key}` |

### SPF Record (1 TXT record)

SPF authorizes which servers can send email for your domain. We use a bounce subdomain as the envelope sender for better deliverability tracking.

| Type | Name                  | Value                               |
| ---- | --------------------- | ----------------------------------- |
| TXT  | `send.yourdomain.com` | `v=spf1 include:amazonses.com ~all` |

### MX Record (1 MX record)

Routes bounce notifications to AWS SES so failed deliveries are tracked and subscribers are marked as bounced.

| Type | Name                  | Value                                   | Priority |
| ---- | --------------------- | --------------------------------------- | -------- |
| MX   | `send.yourdomain.com` | `feedback-smtp.us-east-1.amazonses.com` | 10       |

### Inbound Reply MX Record (1 MX record)

Routes replies to Sequenzy when reply tracking uses your own domain. This enables branded reply addresses such as `reply+{emailId}@inbound.yourdomain.com`.

| Type | Name                     | Value                                  | Priority |
| ---- | ------------------------ | -------------------------------------- | -------- |
| MX   | `inbound.yourdomain.com` | `inbound-smtp.us-east-1.amazonaws.com` | 10       |

<Note>
  If you send from a subdomain like `news.example.com`, the inbound reply MX
  record uses the root domain: `inbound.example.com`.
</Note>

## Optional: DMARC

DMARC is **not required** for domain verification, but we recommend setting it up for better deliverability and domain protection. DMARC tells receiving servers what to do when authentication fails and where to send reports.

<Card title="Implementing DMARC" icon="shield-halved" href="/guides/dmarc">
  Learn how to set up DMARC for your domain with step-by-step instructions
</Card>

## Verification Methods

### Option 1: Automatic Setup with Domain Connect

If your DNS provider supports Domain Connect, you can set up the required records from Sequenzy without copying values into your DNS dashboard manually.

**Step 1: Start automatic setup**

1. Go to **Settings → Domains** and click your domain
2. Click **Auto Configure DNS**
3. Sign in to your DNS provider if prompted
4. Review and approve the DNS changes

Sequenzy uses Domain Connect discovery to detect DNS providers that expose the standard `_domainconnect` record and support Sequenzy's template.

**Step 2: Return to Sequenzy**

After your DNS provider applies the records, it redirects you back to Sequenzy. Verification starts automatically and can still take a few minutes while DNS and AWS SES finish processing the changes.

<Note>
  Domain Connect does not give Sequenzy permanent access to your DNS account.
  The provider approval page applies only the records shown for this setup.
</Note>

## Custom Tracking Domains

Custom tracking domains use one additional CNAME record so tracked clicks and
open pixels use your branded host, for example `links.yourdomain.com`.

If your DNS provider supports Domain Connect and the Sequenzy click-tracking
template, Settings -> Email Tracking shows an automatic setup button for this
CNAME. Otherwise, copy the CNAME from the manual setup table.

| Type  | Name                   | Value                    |
| ----- | ---------------------- | ------------------------ |
| CNAME | `links.yourdomain.com` | `links1.sequenzydns.com` |

## Branded Reply Domains

Branded reply routing uses one MX record so trackable reply-to addresses can use
your domain, for example `reply+id@inbound.yourdomain.com`.

New sending-domain automatic setup includes this record. If you enable branded
replies later and the record is missing, Settings -> Email Tracking shows a
separate automatic setup button when your DNS provider supports the Sequenzy
inbound-replies template.

| Type | Name                     | Value                                 |
| ---- | ------------------------ | ------------------------------------- |
| MX   | `inbound.yourdomain.com` | `inbound-smtp.<region>.amazonaws.com` |

## Landing Page Domains

Landing page custom domains use a CNAME record so published landing pages can
serve from your branded host, for example `pages.yourdomain.com`.

If your DNS provider supports Domain Connect and the Sequenzy landing-page
template, the Landing Pages workspace shows an automatic setup button for this
CNAME. If Vercel requires an ownership verification TXT record, Sequenzy uses a
second Domain Connect template that includes both records.

| Type  | Name                     | Value                   |
| ----- | ------------------------ | ----------------------- |
| CNAME | `pages.yourdomain.com`   | `pages.sequenzydns.com` |
| TXT   | `_vercel.yourdomain.com` | `vc-domain-verify=...`  |

### Option 2: Manual DNS Setup

1. Go to **Settings → Domains** and click your domain
2. Copy each DNS record from the verification table
3. Add them in your DNS provider's control panel
4. Return to Sequenzy and click **I've added the records**

**Common DNS Providers:**

| Provider  | Where to Find DNS Settings                          |
| --------- | --------------------------------------------------- |
| GoDaddy   | My Products → Domains → DNS                         |
| Namecheap | Domain List → Manage → Advanced DNS                 |
| Route 53  | Hosted zones → Select domain → Create record        |
| HostGator | Hosting → Launch cPanel → Zone Editor (see warning) |

<Warning>
  HostGator has two DNS editors, and only one of them is live. If your domain
  uses `nsXXXX.hostgator.com` hosting nameservers, records added under **Domains
  → your domain → DNS** in the customer portal are never published. Use
  **Hosting → Launch cPanel → Zone Editor** instead. See [Records saved but
  never detected](#records-saved-but-never-detected-wrong-dns-editor) below.
</Warning>

<Warning>
  DNS propagation can take up to 48 hours, though most records propagate within
  15-30 minutes.
</Warning>

## Verification Process

Once you've confirmed the DNS records were added, Sequenzy monitors their status:

1. **DNS Lookup** - Checks if records exist and point to correct values
2. **AWS SES Verification** - Once DNS is correct, AWS SES verifies the DKIM signatures
3. **Inbound Routing** - Once the inbound MX record is verified, Sequenzy connects the receipt rule for branded reply tracking
4. **Status Update** - Domain status updates from "Pending" to "Verified"

### Verification Statuses

| Status            | Description                                                                                                         |
| ----------------- | ------------------------------------------------------------------------------------------------------------------- |
| **Not started**   | Records are shown, but setup has not been confirmed yet                                                             |
| **Pending**       | Records still propagating, or waiting for the email provider to confirm - your side is done                         |
| **Verified**      | All records verified, ready to send emails                                                                          |
| **Misconfigured** | A record exists but has the wrong value (for example a conflicting MX left over from a previous provider) - act now |
| **Failed**        | Required records are missing, or the email provider reported a verification failure                                 |

Only **Verified** domains can send. A verified domain is never demoted because
of a temporary DNS hiccup: a status only changes after repeated, confirmed
checks. While Sequenzy double-checks an inconsistent answer, the domain shows
a "Rechecking DNS records" hint and keeps sending. If a verified domain does
lose verification, the dashboard shows exactly which record is missing or
wrong so you can fix it, and the domain returns to verified automatically on
the next successful check.

## Troubleshooting

### Records Not Detected

* **Wait for propagation** - DNS changes can take up to 48 hours
* **Check for typos** - Ensure record names and values match exactly
* **Check proxy settings** - For Cloudflare, DKIM records must have proxy disabled (DNS only)

### Records Saved but Never Detected (Wrong DNS Editor)

If you added the records, they show in your provider's dashboard, but verification keeps reporting them as missing even after hours, you are probably editing a DNS zone that your domain does not actually use. Some providers keep two separate copies of your DNS: one attached to the domain registration and one attached to the hosting account. Only the copy served by your domain's active nameservers is live - changes to the other copy are saved but never published.

**How to check which zone is live:**

1. Find your domain's nameservers (in your provider's dashboard, or run `dig NS yourdomain.com`)
2. Make sure the DNS editor you are using belongs to the account or product those nameservers point to
3. After saving a record, verify it resolves publicly:

```bash theme={null}
dig TXT sequenzy._domainkey.mail.yourdomain.com
```

If this returns nothing several minutes after saving, the record is not being published - you are editing the wrong zone, not waiting on propagation.

**HostGator specifically:** HostGator shows a DNS editor in two places, and only one is live depending on your nameservers:

* If your domain uses hosting nameservers such as `ns8153.hostgator.com` (the default when you have a HostGator hosting plan), DNS is served from your hosting account. Add records via **Hosting → Launch cPanel → Zone Editor → Manage** next to your domain. TXT records are added from the **Add Record** dropdown on the Manage page.
* The **Domains → your domain → DNS** tab in the HostGator customer portal edits a registrar-side zone. When the domain points at hosting nameservers, records saved there are never published, even though the dashboard shows them as saved.

**cPanel refuses to save with a CNAME error:** cPanel validates the entire zone on save. If you see an error like `Only 1 "CNAME" record may exist per name` for a record you did not touch (often `cpanel.yourdomain.com` or `webmail.yourdomain.com`), the zone contains pre-existing duplicate records that block all changes. Filter the record list for that name, delete the duplicate CNAME row, then save your new records again.

### Verification Is Stuck

If verification stays pending or misconfigured:

1. Delete the domain in Sequenzy
2. Re-add it to get a fresh DKIM key
3. Update your DNS records with the new values

### Branded Replies Not Active

If `reply+{emailId}@inbound.yourdomain.com` is not active yet:

1. Confirm the inbound MX record points to the region-specific `inbound-smtp` endpoint shown in Sequenzy
2. Return to **Settings -> Email Tracking** and refresh the Reply-to Domain status
3. Leave the Reply-to Domain setting on **Sequenzy** until inbound routing shows as active if you want to avoid fallback behavior

### Cloudflare Token Errors

| Error                     | Solution                                       |
| ------------------------- | ---------------------------------------------- |
| "Invalid API token"       | Check the token wasn't revoked or expired      |
| "Could not access zone"   | Ensure token has Zone - Zone - Read permission |
| "Failed to create record" | Ensure token has Zone - DNS - Edit permission  |

## Using Subdomains

We strongly recommend sending from a subdomain (e.g., `mail.example.com`) rather than your root domain. This protects your domain reputation and isolates any deliverability issues.

<Card title="Why Use Subdomains?" icon="layer-group" href="/guides/subdomain-sending">
  Learn about reputation isolation, risk prevention, and best practices for
  subdomain email sending
</Card>

## Best Practices

1. **Use a subdomain** - Protect your root domain's reputation with `mail.yourdomain.com`
2. **Consider setting up DMARC** - While optional, DMARC protects against spoofing and helps monitor email authentication
3. **Keep tokens secure** - Never share your Cloudflare API token publicly
4. **Verify inbound replies before switching** - Keep the Reply-to Domain setting on **Sequenzy** until the inbound MX record and routing status are active

## Related

<CardGroup cols={2}>
  <Card title="Using Subdomains" icon="layer-group" href="/guides/subdomain-sending">
    Protect your domain reputation
  </Card>

  <Card title="Implementing DMARC" icon="shield-halved" href="/guides/dmarc">
    Set up DMARC for your domain
  </Card>

  <Card title="Quick Start" icon="rocket" href="/quickstart">
    Get started sending emails
  </Card>

  <Card title="Transactional Emails" icon="code" href="/concepts/transactional-emails">
    Send triggered emails via API
  </Card>
</CardGroup>