Verify a sending domain
Verify a domain before sending from it. You need access to its DNS provider and permission to manage domains in your workspace.
Add the domain
Open Domains in the dashboard and choose Add domain. Enter a domain you control, such as mail.example.com.
A dedicated subdomain helps separate sending streams and DNS configuration. It does not guarantee that reputation problems stay isolated from the rest of your domain.
Free inbox domains such as gmail.com and shared platform domains such as vercel.app cannot be used. You need a domain whose DNS records you can publish.
Prove ownership
When the setup asks for ownership proof, publish the TXT record it gives you. Its value starts with epostix-verification= and is specific to this domain registration.
The record belongs on the domain you added. For mail.example.com, publish it at mail.example.com, not at tix.mail.example.com. In an example.com DNS zone, the relative host is mail. Use @ only when the domain you added is the zone's root.
Keep existing TXT records. Add the ownership value as a separate record, then run the ownership check. Once ownership is confirmed, the proof record can be removed. Keep the mail records from the next step in place for as long as you send.
Older domains may not require this step. Follow the requirements shown for your domain.
Publish the DNS records
New domains need these mail records:
| Record | Purpose | Required on new domains |
|---|---|---|
| SPF TXT | Authorizes Epostix's sending servers for the envelope-sender domain | Yes |
| DKIM TXT | Publishes the key used to verify message signatures | Yes |
| DMARC TXT | Publishes the domain's authentication policy | Yes |
| Two MX records | Route bounce reports and incoming mail at the configured mail host | Yes, both |
| OpenPGP CNAME | Publishes the OpenPGP key directory | No |
Older domains can have fewer required records. The dashboard marks each record as required or recommended; those flags determine whether your domain verifies.
Copy the values from your domain page. DKIM keys and ownership tokens are specific to your domain, so another domain's values will not work.
Where SPF and the MX records go
The sending subdomain defaults to tix. For a domain added as mail.example.com, SPF and MX records belong at tix.mail.example.com. DKIM and DMARC belong under mail.example.com itself.
You can change the sending subdomain before verification. Changing it reissues the affected records and restarts verification. Once the domain is verified, it is fixed.
Check the DNS zone you are editing. If your provider appends example.com, enter tix.mail to create tix.mail.example.com. If you have a separate delegated zone for mail.example.com, enter tix there. Do not append the zone name twice.
Publishing SPF and MX on the domain itself can conflict with an existing mail provider. Keep the default subdomain unless you intend to change mail routing. DNS records explains the tradeoff.
Select your DNS provider in the records panel when available. It adjusts host and value formatting. The Zone file download gives you the full record names in BIND format.
For Cloudflare, use DNS only for mail-related CNAME records. TXT and MX records are already DNS-only. See Cloudflare's proxy guidance.
Wait for the check
Epostix checks records automatically during setup. Use Check now after publishing them to request another check. You do not need to keep the page open.
Failed checks become less frequent while DNS propagates. The domain page shows the next check. If the initial verification window ends after roughly three and a half days, publish or repair the records and use Check now to restart it.
DNS caching can delay verification. Check that the authoritative DNS provider has the correct record before waiting for caches to expire.
When a record does not match
| Problem | What to check |
|---|---|
| Nothing found | Confirm the full hostname and the authoritative DNS zone |
| Domain appears twice in the hostname | Remove the part your provider appends automatically |
| Existing SPF record | Merge Epostix's include: into that record; do not create a second SPF policy |
| MX points to your existing inbox provider | Use a separate sending subdomain instead of replacing inbox routing |
| TXT value differs | Copy the complete value; use the provider's expected quoting format |
| MX target differs only by a trailing dot | Check whether the provider expects a fully qualified target; do not add the local zone to it |
The dashboard shows the observed value when one is available. Compare the complete hostname, record type and value with the expected record. DNS records explains what each check means.
Verified
When ownership is proven where required and every required mail record passes, the domain becomes Verified. You can send from addresses at that domain. Verifying mail.example.com does not also verify example.com.
Required mail records are checked again every 24 hours. If one stops resolving, Epostix reports the problem and checks hourly during a 72-hour grace period. Sending stops if the required records remain broken when that period expires.
Restore the records and run Check now. A domain deactivated because of DNS drift can return to verified when its required records pass again. Check the reported reason if the domain remains disabled.