Skip to main content
Marketing email can only go out from a domain you own and have verified. Verifying proves the domain is yours and lets Senderz sign every message with your own DKIM key, so mailbox providers trust the mail. Domains live in Settings → Domains & senders. The same screen holds your sender addresses and sender names.

​
Adding a domain

1

Add the domain

Open Settings → Domains & senders and choose Add domain. Enter the domain used in your From addresses, for example example.com. Senderz places its own MX record on a separate bounce subdomain, so your business email keeps working.
2

Publish the DNS records

Expand the new row. Senderz generates the records and groups them by what they do. Add each one at your DNS provider, or use Auto-add records if your provider supports it.
3

Wait for verification

Verification runs on its own in the background. Once the records resolve, the domain flips to Verified. You can close the page.
4

Add a sender address

A verified domain is not enough on its own. Add and confirm at least one sender address before you can send. See Sender addresses & names.
Use your root domain, not a subdomain, unless you have a reason to separate them. SPF is published at the hostname you add and DMARC at _dmarc. in front of it, so adding mail.example.com publishes a policy for that subdomain only, not for your organisation.

​
Hostnames you cannot add

Some hostnames belong to a storefront or hosting platform, not to you. You cannot publish SPF, DKIM or DMARC records for them, so a domain like that could never verify. Senderz refuses them at the point of adding, with a message naming the platform. This covers myshopify.com, konimbo.co.il, wixsite.com, wix.com, squarespace.com, webflow.io, wordpress.com, blogspot.com, github.io, vercel.app, netlify.app, pages.dev, herokuapp.com, web.app and around fifteen more, plus anything beneath them. Add the domain you bought instead. A subdomain of your own domain such as mail.example.com or send.example.com is always allowed, because you control that zone.
A hostname can belong to only one Senderz workspace. If someone else has already added it, you get This domain is already added. Remove it from the other workspace first.

​
The DNS records

The records table is grouped the way the product groups them.
DKIM is a TXT record at s1._domainkey. in front of your domain. It carries the public half of your signing key.DKIM (delivery) is up to three CNAME records. They are required for verification, and they are easy to miss because there are several of them and they look similar.
SPF is a TXT record on the domain itself:
Both includes must be present. A domain whose SPF is missing one of them stays on Partial and cannot send, even if everything else resolves. If you already have an SPF record, merge the includes into the existing one rather than publishing a second SPF record.MAIL FROM (Return-Path) and MX are only shown when you turn on the custom Return-Path. See below.
A TXT record at _dmarc. in front of your domain:
The group is labelled Optional because a domain verifies without it. Publish it anyway. It tells mailbox providers how to treat mail that fails authentication, and Gmail and Yahoo expect bulk senders to have one.
A CNAME at track. in front of your domain. It serves open pixels and click redirects from your own subdomain instead of a shared one, which reads better to recipients and to filters. A domain verifies without it.
Only four checks decide verification: SPF, DKIM, DKIM (delivery), and MAIL FROM when the custom Return-Path is on. DMARC and Tracking never block verification.
Above the table you get Copy all and Download, which saves the records as a zone file. DNS changes can take up to 24 to 48 hours to spread, and you can leave the page while that happens.

​
The custom Return-Path

The Use a custom Return-Path switch sits in the Return-Path group. It is off by default, and leaving it off is a perfectly good choice.
Bounces go to the Amazon default return address. Nothing else changes. You publish no MX record, and no MX record is required to verify the domain. Your DKIM signature still aligns with your domain, so DMARC still passes.The Return-Path group tells you this on screen: custom Return-Path is off, so bounces use the Amazon default, and the SPF record below is still required.
Flipping the switch changes which records are required, so Senderz re-runs verification straight away rather than leaving the status stale.

​
Automatic DNS setup

When you expand an unverified domain, a bar at the top names the DNS provider Senderz detected for it. If your provider supports one-click setup, you get an Auto-add records button. Choosing it sends you to your provider, you approve the change there, and the records land in your account. Domain Connect is the standard behind this, and it is what most merchants will hit, including many Cloudflare-hosted domains. If it is not available you see Automatic setup isn’t enabled for this provider yet or Add the records below at your DNS provider, and you add the records by hand. That is the normal path for most providers today.
Automatic setup only ever writes the records Senderz generated for this domain. It does not read or change any other DNS record.

​
The step-by-step guide

Below the bar there is a DNS provider picker with written instructions for Cloudflare, GoDaddy, Shopify, Route 53, Google, Squarespace and a generic option, each with a link to that provider’s own documentation. Pick yours if you are not sure where the records go.

​
How verification works

You do not have to click anything. Senderz re-checks pending domains in the background about once a minute. While you have a pending domain’s row open, it also re-checks every few seconds, so records you just published usually turn green while you are still looking at the page. Verify records is a check-now button, not a requirement. Each domain shows one of four statuses. The row also shows SPF, DKIM and DMARC individually, so you can see which one is holding you up.

​
Staying verified

The background check keeps running after a domain verifies. If the records later disappear, the domain is demoted back to Partial or Pending, and that immediately blocks sending from every address on it. Demotion is deliberately slow to trigger. A verified domain has to fail three checks in a row, roughly three minutes, before it is demoted. A single check that passes resets the count, so a brief DNS hiccup will not knock you offline. You get a notification when a verified domain is demoted, and another one when it recovers.
Do not delete Senderz records during a DNS cleanup. Losing the DKIM or SPF record stops your marketing email a few minutes later, and campaigns scheduled for that window will fail.

​
DKIM keys never leave AWS KMS

Your DKIM private key is generated inside AWS KMS and never leaves it. Signing happens by calling KMS at send time, so the application never holds the raw key and it can never be exported or logged. This key is your domain’s reputation.

​
Blocklist checks

Senderz checks every verified sending domain against the Spamhaus domain blocklist, which mailbox providers use to filter mail. The sweep runs every ten minutes and each domain is re-checked about every six hours. A newly added domain is checked straight away.

Listed

Sending from the domain is blocked. Campaigns using a From address on it are refused with a message saying the domain is on the Spamhaus blocklist. Request delisting, then send.

Abused but legitimate

Spamhaus has flagged the domain as a real site that has been abused, for example through a hacked page. Sending is not blocked, but delivery will suffer until it is resolved.
Both states show up before you send. The campaign review step flags a listed domain as an error and an abused-but-legitimate domain as a warning, and you get a notification when a domain is listed and another when it clears. To resolve a listing, look the domain up in Spamhaus’s own blocklist removal centre at check.spamhaus.org and follow their delisting process. Listings are usually caused by something on the domain itself, such as a compromised page or a redirect to spam content, so fix that first or the listing comes straight back.

​
Warmup

A verified domain starts warming up automatically. Expand the row to see progress. See Warmup & reputation.

​
DMARC reports

The DMARC report viewer card on this page is a placeholder marked Available in Pro. Aggregate report parsing and sender breakdowns are not built yet. What works today is the DMARC record verification status shown per domain.

​
Removing a domain

Choose Remove on the domain row. You will need to add it again and set up DNS from scratch to send from it, and every sender address on it goes with it. Removing your last domain also schedules your workspace’s DKIM signing key for deletion, after a waiting period. Adding a domain again creates a new one.

​
Who can do what

​
Next

Sender addresses & names

Confirm the mailboxes you send from and set a workspace default sender.

Warmup & reputation

How volume ramps and how reputation is monitored.