Verify a domain

Add the domain

Go to Domains → Add domain. Enter the name (example.com or a subdomain such as mail.example.com). Select the DNS provider (Cloudflare or Manual). Select the optional features:

• Tracking — creates link.<domain> for open and click tracking.
• Inbound — creates reply.<domain> so that replies arrive in the console.

When you create the domain, the platform generates two 2048-bit DKIM key pairs (ep1 active, ep2 standby) and the expected DNS records. It also queues the first verification. The console then opens the domain page.

A new domain starts with the Transactional stream, so the API refuses bulk kinds from it. For newsletters and digests, add news.<domain> as its own domain and set its stream to Bulk on the domain page. See Streams.

The records

Every domain gets these records. The domain page shows the values with copy buttons. The placeholders below use <domain> and the SES region (us-east-1).

Purpose	Type	Name	Value
DKIM (×2)	TXT	ep1._domainkey.<domain>, ep2._domainkey.<domain>	v=DKIM1; k=rsa; p=… (per key)
Return-Path MX	MX 10	bounce.<domain>	feedback-smtp.us-east-1.amazonses.com
Return-Path SPF	TXT	bounce.<domain>	v=spf1 include:amazonses.com -all
DMARC	TXT	_dmarc.<domain>	v=DMARC1; p=none; rua=mailto:<domain>-<tag>@dmarc.f5send.com; fo=1; adkim=s; aspf=r; pct=100
Tracking (optional)	CNAME	link.<domain>	link.f5send.com
Inbound (optional)	MX 10	reply.<domain>	inbound-smtp.us-east-1.amazonaws.com
MTA-STS / TLS-RPT (optional)	TXT, TXT, CNAME	_mta-sts.<domain>, _smtp._tls.<domain>, mta-sts.<domain>	v=STSv1; id=…, v=TLSRPTv1; rua=mailto:…@dmarc.f5send.com, mta-sts.f5send.com

The DMARC rua address is unique per domain. This lets the platform route the reports to the DMARC tab of your domain.

The policy ramps in three steps: p=none while the domain verifies, p=quarantine once it sends, and p=reject when the DMARC tab recommends it. The recommendation needs 30 days of reports, 99 % alignment, and no source that fails alignment. A mailbox in another Google Workspace that sends as your domain fails alignment. It blocks the last step until it signs with the key of your domain.

Cloudflare vs manual

MTA-STS starts in testing mode. Move it to enforce on the domain page after a clean week of TLS-RPT reports.

• Cloudflare — click Publish to Cloudflare. The platform upserts every expected record in the zone through a zone-scoped API token. It then queues a verification. Run it again after you enable Tracking, Inbound or MTA-STS.
• Manual — copy each Name and Value into your DNS provider. Then click Verify now.

Register with SES

An admin clicks Register with SES once. This action creates the SES identity for the domain. The identity uses your DKIM key (BYODKIM) and bounce.<domain> as the MAIL FROM domain. Without this step, verification can pass, but sends fail.

What VERIFIED means

The worker resolves each record against public DNS and marks it OK, Mismatch or Missing. The domain becomes Verified when the active DKIM record, the Return-Path MX and SPF, and the DMARC record are all OK. The Tracking, Inbound and MTA-STS records are optional and never block verification.

• Pending — the worker checks the domain every 5 minutes. If the domain has never verified after 72 hours, it becomes Failed. The worker continues to check it. Correct the records and click Verify now.

• Verified — the worker checks the domain daily. If a required record breaks, the domain goes back to Pending. A DNS drift alert can fire (see Metrics & alerts).

• Disabled — an admin turned sending off. Verification continues to run but never changes the status.

Warm-up

Each domain has a warm-up stage (0–6) with a daily send allowance: 200, 500, 1,000, 2,000, 5,000, 10,000, then unlimited. New domains start at stage 0. A daily job raises or lowers the stage from the bounce and complaint rates of the previous UTC day (see Deliverability). The worker does not drop messages over the allowance of the day. It parks them and retries every 15 minutes. A burst thus spreads over the following days.