> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sendbaze.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How verification works

> What each DNS record does, how Sendbaze checks them, and what the per-record statuses mean.

Receivers such as Gmail and Outlook decide whether to trust your email by checking three things: that the message is signed by the domain in `From` (DKIM), that the server sending it is allowed to (SPF), and that the two agree with `From` (DMARC alignment). Domain verification sets all three up.

## The records

When you add a domain, Sendbaze creates an identity for it in Amazon SES and returns the records to publish.

> [accordion] Three DKIM CNAMEs (required)
>
> Each points a host like `abc123._domainkey.yourshop.co.za` at a key hosted by SES. SES rotates the keys for you; the CNAMEs never change. Sending is blocked until all three resolve.

> [accordion] Return-path MX (required)
>
> An `MX` record on the return-path subdomain (`mail.yourshop.co.za` by default) pointing at `feedback-smtp.af-south-1.amazonses.com`. Bounces go there and become `email.bounced` events for you.

> [accordion] Return-path SPF TXT (required)
>
> `v=spf1 include:amazonses.com ~all` on the same subdomain. With a custom return path the SPF check passes on a domain you control, which is what DMARC alignment needs.

> [accordion] DMARC TXT (advised)
>
> A `_dmarc.yourshop.co.za` TXT such as `v=DMARC1; p=none; rua=mailto:dmarc@yourshop.co.za`. Start with `p=none` to receive reports without affecting delivery, then move to `quarantine` and `reject` once every legitimate sender is authenticated. Sendbaze verifies without it but warns while it is missing.

## How checking works

* Every five minutes while a domain is pending, and daily once it is verified, Sendbaze looks up each record in public DNS and asks SES for its own view.
* Each record shows `pending`, `verified` or `failed`, plus what DNS currently returns under **found**. A wrong value therefore reads "found: `old-value`" instead of an unexplained pending.
* `POST /v1/domains/{id}/verify` and the **Check now** button run the same check immediately.
* If a wildcard record at your DNS host answers for a name you have not published, the record is flagged; publishing the exact record overrides the wildcard.

## Advice

Beyond pass or fail, every check leaves a short list of findings on the domain (`advice` in the API, the notes under the records on the Domains page). Each has a level: **warn** means fix it before sending in volume, **info** is worth knowing.

| Code | Level | Meaning |
| - | - | - |
| `free_mailbox_domain` | warn | The domain belongs to a mailbox provider (gmail.com, outlook.com, mweb.co.za) and can never be verified |
| `dmarc_missing` | warn | No `_dmarc` record; Gmail and Yahoo require one from bulk senders |
| `dmarc_invalid`, `dmarc_multiple` | warn | The `_dmarc` record is malformed, has no valid `p=` policy, or is duplicated |
| `dmarc_policy_none` | info | DMARC is monitoring only; move to `quarantine` once your other senders are aligned |
| `dmarc_no_reports` | info | No `rua=` address, so you receive no aggregate reports |
| `spf_root_missing` | info | No SPF on the apex. Sendbaze mail still passes SPF through the return-path subdomain; your other senders need it |
| `spf_root_multiple`, `spf_root_permissive`, `spf_too_many_lookups` | warn | Two SPF records, `+all`, or more than 10 DNS lookups: all make SPF fail |
| `aligned` | info | DKIM and the return path align with your From address under DMARC |

## Statuses

| Status | Meaning |
| - | - |
| `pending` | Waiting for one or more required records. Live sends from this domain fail with `domain_not_verified`. |
| `verified` | Every required record resolves and SES has confirmed DKIM and the return path. Sending is allowed from the domain and any subdomain. |
| `failed` | SES could not verify within 72 hours. Fix the records and check again; the domain returns to pending. |

## Common problems

* **Proxied CNAMEs on Cloudflare**: switch the three DKIM records to DNS only.
* **A trailing dot or the full host repeated**: some registrars add your domain to the host automatically. Enter `abc123._domainkey`, not `abc123._domainkey.yourshop.co.za`, when the registrar appends the domain.
* **An existing SPF record on the root domain**: the return-path SPF lives on the `mail` subdomain, so it never conflicts with your root SPF. Leave your root record alone.
* **MX conflicts**: the MX goes on the `mail` subdomain, not the root, so your mailbox provider's MX records are untouched.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.