Skip to main content
Receivers such as Gmail and Outlook decide whether to trust your email by checking three things: that the message is signed by the domain in From (DKIM), that the server sending it is allowed to (SPF), and that the two agree with From (DMARC alignment). Domain verification sets all three up.

​
The records

When you add a domain, Sendbaze creates an identity for it in Amazon SES and returns the records to publish.
Each points a host like abc123._domainkey.yourshop.co.za at a key hosted by SES. SES rotates the keys for you; the CNAMEs never change. Sending is blocked until all three resolve.
An MX record on the return-path subdomain (mail.yourshop.co.za by default) pointing at feedback-smtp.af-south-1.amazonses.com. Bounces go there and become email.bounced events for you.
v=spf1 include:amazonses.com ~all on the same subdomain. With a custom return path the SPF check passes on a domain you control, which is what DMARC alignment needs.
A _dmarc.yourshop.co.za TXT such as v=DMARC1; p=none; rua=mailto:dmarc@yourshop.co.za. Start with p=none to receive reports without affecting delivery, then move to quarantine and reject once every legitimate sender is authenticated. Sendbaze verifies without it but warns while it is missing.

​
How checking works

  • Every five minutes while a domain is pending, and daily once it is verified, Sendbaze looks up each record in public DNS and asks SES for its own view.
  • Each record shows pending, verified or failed, plus what DNS currently returns under found. A wrong value therefore reads “found: old-value” instead of an unexplained pending.
  • POST /v1/domains/{id}/verify and the Check now button run the same check immediately.
  • If a wildcard record at your DNS host answers for a name you have not published, the record is flagged; publishing the exact record overrides the wildcard.

​
Advice

Beyond pass or fail, every check leaves a short list of findings on the domain (advice in the API, the notes under the records on the Domains page). Each has a level: warn means fix it before sending in volume, info is worth knowing.

​
Statuses

​
Common problems

  • Proxied CNAMEs on Cloudflare: switch the three DKIM records to DNS only.
  • A trailing dot or the full host repeated: some registrars add your domain to the host automatically. Enter abc123._domainkey, not abc123._domainkey.yourshop.co.za, when the registrar appends the domain.
  • An existing SPF record on the root domain: the return-path SPF lives on the mail subdomain, so it never conflicts with your root SPF. Leave your root record alone.
  • MX conflicts: the MX goes on the mail subdomain, not the root, so your mailbox provider’s MX records are untouched.