Domains & DNS
You can only send from a domain you have verified. Four steps, then you are sending.
Add the domain
In Dashboard → Domains → Add domain, enter the domain you send from (yourdomain.com, not mail.yourdomain.com, unless that subdomain is what appears in your from address). cmdsend generates a unique DKIM keypair for it on the spot.
Publish the DNS records
The domain's page shows the exact values to copy. cmdsend uses BYODKIM — one DKIM record instead of the traditional three CNAMEs — plus a dedicated MAIL FROM subdomain so SPF aligns for DMARC.
<selector>._domainkey.yourdomain.comDKIM public key — proves ownership and signs outgoing mail.
send.yourdomain.comRoutes bounce notifications to feedback-smtp.<region>.amazonses.com, priority 10.
send.yourdomain.comSPF record on the MAIL FROM domain — v=spf1 include:amazonses.com ~all.
_dmarc.yourdomain.comOptional DMARC policy record.
Most providers add the domain to the record name automatically — if yours does, enter just send rather than send.yourdomain.com.
Wait for verification
Verification runs on its own — every 30 seconds for the first 10 minutes, then every 5 minutes, for up to 72 hours. You can also trigger an immediate check from the domain's page. DKIM and MAIL FROM verify independently; the domain is ready once both show success.
Most DNS providers propagate within 15 minutes, though some take a few hours. Nothing is required from you while you wait.
Send a test email
Once the domain is verified, send from any address on it.
await cmdsend.emails.send({
from: 'hello@yourdomain.com',
to: 'you@example.com',
subject: 'Domain verified',
text: 'Sending from my own domain.',
});A 403 here means the domain is not verified yet — the message names the domain it checked.
Troubleshooting
| Symptom | What to check |
|---|---|
| Still pending after an hour | Your DNS provider may have appended the domain to the record name, producing send.yourdomain.com.yourdomain.com. Check the record as it actually resolves, not as you typed it. |
| DKIM verified, MAIL FROM not | The MX and SPF records on send.yourdomain.com are missing or incomplete. They verify independently of DKIM — both must succeed before you can send. |
| The DKIM value looks truncated | It is a long public key. Some providers split long TXT values into chunks, which is fine, but a provider that silently truncates at 255 characters is not — paste the value in full. |
| Sending returns 403 Forbidden | The from domain is not verified yet, or you are sending from a different domain than the one you verified. The error names the domain it looked for. |
Key rotation
DKIM keys don't rotate automatically — you'll see a reminder after 12 months. Rotating publishes a second DKIM TXT record alongside the current one; signing only cuts over once the new record is confirmed live on public DNS, and the old key stays published for 7 days afterward so nothing breaks mid-rotation.
Managing domains via API
Domain endpoints accept the same Bearer API key as email sending:
curl -X POST https://cmdsend.com/api/domains \
-H "Authorization: Bearer cmd_your_api_key" \
-H "Content-Type: application/json" \
-d '{"domain": "yourdomain.com"}'Full endpoint list in the API Reference.