Verifying your sending domain

Sending from your own domain is what makes your email yours: your name in the inbox, your reputation, your deliverability. It costs seven DNS records, published once. Until a domain is verified, your emails go out under a shared AgentsMail address — usable to get started, and not something to keep.

The records, and what each is for

RecordsPurposeGates sending
3 × CNAME (DKIM)Signs your emails cryptographicallyYes
1 × TXT (ownership)Proves this organization owns the domainYes
1 × MX + 1 × TXT (MAIL FROM)Aligns the technical return pathNo
1 × TXT (DMARC)Tells receivers what to do with fakesNo
Only DKIM and the ownership proof gate sending. MAIL FROM and DMARC are informational here — they improve deliverability, they do not unlock it.

DKIM and ownership are two different problems

They look alike and they fail differently, which is why the product reports them separately:
  • Waiting on DNS — the DKIM CNAMEs are not visible yet. Publish them, or wait for propagation.
  • Ownership to prove — DKIM passed, but the _agentmail-challenge TXT record is missing. DKIM says an email was signed by that domain's keys; it does not say this organization is entitled to use it. The challenge does.
Reading one message as the other is the classic wasted afternoon: republishing DKIM records that were already fine.

Publishing them

If your DNS provider supports automatic setup, the product offers to publish all seven records for you, at the provider. Otherwise the records are listed with a copy button for each, and a link to your provider's DNS zone. Same result either way.
Propagation takes up to 72 hours. Usually minutes, sometimes a day. "Verify now" re-reads DNS on demand — nothing is lost by checking, and nothing is gained by publishing twice.

What refuses, and what suspends

Verification fails when the records cannot be read; the state stays at the last known one if the provider itself is unreachable. Sending suspended is different in kind. It means the email provider suspended your organization, generally after a reputation incident — too many bounces or complaints. Resuming is not on your side, and no setting in the product lifts it. See suppressions for what leads there.

What it implies elsewhere

A verified domain changes the rules immediately: your own sender address becomes required, and campaigns stop going out under the shared address. If your sender address is not on a verified domain, the screen says so by name. Removing a domain removes what its addresses stood on. Everything here is also reachable over HTTP — declare a domain, read the records to publish, poll the status: see Settings & domains.