Sign inGet started

Domains & DNS

cmdsend uses BYODKIM (bring-your-own DKIM key) instead of the traditional 3-CNAME setup — one DKIM record instead of three, plus a dedicated MAIL FROM domain so SPF aligns for DMARC.

Records you'll publish

Adding a domain generates a unique keypair and shows you exactly these records:

TXT
<selector>._domainkey.yourdomain.com

DKIM public key — proves ownership and signs outgoing mail.

MX
send.yourdomain.com

Routes bounce notifications to feedback-smtp.<region>.amazonses.com, priority 10.

TXT
send.yourdomain.com

SPF record on the MAIL FROM domain — v=spf1 include:amazonses.com ~all.

TXT
_dmarc.yourdomain.com

Optional DMARC policy record.

Verification

Verification runs automatically in the background — every 30 seconds for the first 10 minutes after you add a domain, then every 5 minutes, for up to 72 hours. You can also trigger an immediate check from the domain's page. DKIM and MAIL FROM verify independently; a domain is fully ready to send once both show success.

Key rotation

DKIM keys don't rotate automatically — you'll see a reminder after 12 months. Rotating publishes a second DKIM TXT record alongside the current one; signing only cuts over once the new record is confirmed live on public DNS, and the old key stays published for 7 days afterward so nothing breaks mid-rotation.

Managing domains via API

Domain endpoints accept the same Bearer API key as email sending:

curl -X POST https://cmdsend.com/api/domains \
  -H "Authorization: Bearer cmd_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"domain": "yourdomain.com"}'

Full endpoint list in the API Reference.