Getting started

Domains & DNS

3 × CNAME · DKIM

To send from your own address you must verify a sending domain. YourMail uses AWS SES Easy-DKIM — you add three CNAME records and SES handles signing. DMARC alignment is satisfied via DKIM alone.

Why use this

Verifying your domain is what lets you send from your own address (like hello@yourcompany.com) instead of a shared one. It also proves to inbox providers that the mail really is from you, which is the single biggest thing keeping your emails out of the spam folder. You add a few DNS records once, and then everything you send is properly signed.

For example

Instead of a generic “via amazonses.com” sender, your customers see mail genuinely from acme.com — and Gmail trusts it enough to land in the inbox, not spam.

Verification flow

Add your domain

Go to Dashboard → Domains and enter your sending domain (e.g. mail.acme.com). YourMail generates three unique DKIM tokens for your domain.

Add the DNS records

Copy the three DKIM CNAME records shown in the dashboard and add them to your DNS provider. The records are unique per domain — do not reuse tokens from another domain.

Wait for propagation

Most DNS providers propagate in a few minutes. Use Recheck in the dashboard to trigger a fresh check at any time. YourMail also polls automatically — frequently for new domains, hourly for older ones.

The three DNS records

All three CNAME records are required for DKIM verification. The record values are shown in your dashboard after you add the domain.

# Replace <token1/2/3> with the values shown in your dashboard.
# Replace example.com with your actual sending domain.
# 1–3. DKIM (3 CNAME records)
<token1>._domainkey.example.com  CNAME  <token1>.dkim.amazonses.com
<token2>._domainkey.example.com  CNAME  <token2>.dkim.amazonses.com
<token3>._domainkey.example.com  CNAME  <token3>.dkim.amazonses.com

# Recommended (not required for verification):
_dmarc.example.com  TXT  "v=DMARC1; p=none;"

#1CNAME<token1>._domainkey.<domain>: <token1>.dkim.amazonses.comDKIM signing key 1 of 3
#2CNAME<token2>._domainkey.<domain>: <token2>.dkim.amazonses.comDKIM signing key 2 of 3
#3CNAME<token3>._domainkey.<domain>: <token3>.dkim.amazonses.comDKIM signing key 3 of 3

One domain, every address

Verification is domain-level, not address-level. Look at the records above: none of them names an address. They prove control of the whole domain, so the moment acme.com verifies, every address on it can send.

support@acme.com
hello@acme.com
no-reply@acme.com

There is no per-address step — not here, and not at your DNS provider. DNS has no record type for an email address, so there is nothing to add and nothing to enable. Choose whatever you like before the @ and put it in the from field. One caveat: sender reputation is shared across the whole domain, so a campaign that gets marked as spam from one address will hurt delivery from all of them. Send bulk mail from a separate subdomain, verified separately.

A from address is not a mailbox

Verifying a domain authorises sending from it. It does not create anywhere to receive. Those are two unrelated systems: sending is proven by the DKIM records above, while receiving needs MX records pointing at a mail host — Google Workspace, Fastmail, or your registrar's forwarding.

So a domain with no MX records sends perfectly and receives nothing. Mail from support@acme.com arrives as expected, and every reply to it bounces — and you will not notice, because the bounce goes back to the person who replied, not to you. Check with dig MX acme.com. If it comes back empty, either add MX records or set replyTo on your sends to an inbox someone actually reads.

DMARC (recommended)

Gmail and Yahoo's bulk-sender requirements mandate a DMARC record on the From domain. Adding a p=none policy satisfies this requirement without affecting delivery — it only enables monitoring. YourMail will not gate verification on this record (you may already have your own DMARC policy), but adding it is strongly recommended:

_dmarc.example.com TXT "v=DMARC1; p=none;"

Pending expiry

A domain that remains unverified for 7 days is automatically expired. The dashboard will tell you when this happens. To retry: remove the domain and add it again to get fresh DKIM tokens, then re-add the DNS records.

Troubleshooting

# After adding all DNS records, trigger a recheck from the dashboard:
# Dashboard → Domains → your domain → Recheck verification

# Verification usually takes a few minutes.
# DNS propagation can take up to 48 hours on some providers.

Verification stuck after >1 hour: Check that CNAME records have the correct host names. Some DNS providers strip the root domain — e.g. enter _token1._domainkey not _token1._domainkey.example.com if your provider auto-appends the domain.
Domain expires after 7 days: Remove the domain from the dashboard, add it again to receive new DKIM tokens, delete the old CNAME records, and add the new ones.
Records added but status still pending: Use Recheck in the dashboard to trigger an immediate poll. DNS propagation can take up to 48 hours on some registrars.

Quickstart Next: Send email