Domains & DNS

You can only send from a domain you have verified. Four steps, then you are sending.

1

Add the domain

In Dashboard → Domains → Add domain, enter the domain you send from (yourdomain.com, not mail.yourdomain.com, unless that subdomain is what appears in your from address). cmdsend generates a unique DKIM keypair for it on the spot.

2

Publish the DNS records

The domain's page shows the exact values to copy. cmdsend uses BYODKIM — one DKIM record instead of the traditional three CNAMEs — plus a dedicated MAIL FROM subdomain so SPF aligns for DMARC.

TXT
<selector>._domainkey.yourdomain.com

DKIM public key — proves ownership and signs outgoing mail.

MX
send.yourdomain.com

Routes bounce notifications to feedback-smtp.<region>.amazonses.com, priority 10.

TXT
send.yourdomain.com

SPF record on the MAIL FROM domain — v=spf1 include:amazonses.com ~all.

TXT
_dmarc.yourdomain.com

Optional DMARC policy record.

Most providers add the domain to the record name automatically — if yours does, enter just send rather than send.yourdomain.com.

3

Wait for verification

Verification runs on its own — every 30 seconds for the first 10 minutes, then every 5 minutes, for up to 72 hours. You can also trigger an immediate check from the domain's page. DKIM and MAIL FROM verify independently; the domain is ready once both show success.

Most DNS providers propagate within 15 minutes, though some take a few hours. Nothing is required from you while you wait.

4

Send a test email

Once the domain is verified, send from any address on it.

await cmdsend.emails.send({
  from: 'hello@yourdomain.com',
  to: 'you@example.com',
  subject: 'Domain verified',
  text: 'Sending from my own domain.',
});

A 403 here means the domain is not verified yet — the message names the domain it checked.

Troubleshooting

SymptomWhat to check
Still pending after an hourYour DNS provider may have appended the domain to the record name, producing send.yourdomain.com.yourdomain.com. Check the record as it actually resolves, not as you typed it.
DKIM verified, MAIL FROM notThe MX and SPF records on send.yourdomain.com are missing or incomplete. They verify independently of DKIM — both must succeed before you can send.
The DKIM value looks truncatedIt is a long public key. Some providers split long TXT values into chunks, which is fine, but a provider that silently truncates at 255 characters is not — paste the value in full.
Sending returns 403 ForbiddenThe from domain is not verified yet, or you are sending from a different domain than the one you verified. The error names the domain it looked for.

Key rotation

DKIM keys don't rotate automatically — you'll see a reminder after 12 months. Rotating publishes a second DKIM TXT record alongside the current one; signing only cuts over once the new record is confirmed live on public DNS, and the old key stays published for 7 days afterward so nothing breaks mid-rotation.

Managing domains via API

Domain endpoints accept the same Bearer API key as email sending:

curl -X POST https://cmdsend.com/api/domains \
  -H "Authorization: Bearer cmd_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"domain": "yourdomain.com"}'

Full endpoint list in the API Reference.