Get Started
Sending & Deliverability
Docs chevron_right Sending & Deliverability chevron_right Sending domains & DKIM

Sending domains & DKIM

Verifying your sending domain is the one setup step between you and your first send. You add a few DNS records to prove you own your domain; our managed delivery infrastructure then sends and DKIM-signs mail as you.

Why authentication matters

Mailbox providers (Gmail, Outlook, and the rest) trust mail far more when the sender proves they own the domain it comes from. Authentication is what separates legitimate senders from spoofers. Without it, even great email risks landing in spam; with it, your inbox placement improves immediately.

What DKIM does

DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to every message. The receiving server checks that signature against a public key published in your domain's DNS to confirm the message is genuinely from you and wasn't tampered with in transit. EmailFlow AI generates the key and signs each message for you — you simply publish the record.

DMARC (recommended)

DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receiving servers what to do with mail that fails SPF or DKIM, and protects your domain from spoofing. It's optional and never required to send, so we show it as a recommended row that doesn't affect your verified count. We suggest starting in monitoring mode — publish a TXT record at _dmarc.yourdomain.com with the value v=DMARC1; p=none;, which never affects delivery while you confirm everything looks right. You can tighten the policy to quarantine or reject later. See Amazon SES's DMARC guide for the full rollout.

How to authenticate

  1. Add your sending domain in your account settings.
  2. EmailFlow AI generates the DNS records to add, including your DKIM record.
  3. Copy them into your domain's DNS (at your registrar or DNS host).
  4. Return and verify — once the records resolve, your domain is authenticated.
emailflow.ai/rui/sending/domains
A pending sending domain showing the DNS records to publish: a domain-identity TXT record and a DKIM signature TXT record, each with host, value, a copy button, and a pending status, plus a Verify DNS records button
The records table — copy each host and value into your DNS, then click Verify DNS records.
dns
Verifying your domain is the only setup step — we run the sending infrastructure. Publish the records, click Verify, and start sending.

After authentication

With your domain verified, every address at it is a usable sender identity — no per-address verification needed. A tracking domain is reserved for you automatically as well — publish its recommended CNAME record so open and click links use your own domain too. We also recommend publishing the DMARC record above. Together these complete a professional, inbox-friendly sending setup.

Frequently asked questions

Why do I need to verify a domain? Verification (via DNS records like DKIM) proves you're authorized to send from your domain. It's what lets our infrastructure send as you — and it's what keeps your mail out of spam.

How long does it take? Adding the DNS records takes a few minutes; DNS hosts may need a little time to publish them. Once they're detected, your domain is ready and you can send from any address at it.

Can I use a subdomain? Yes — many senders use a dedicated subdomain (for example, mail.yourdomain.com) to keep marketing reputation separate from their primary domain.