Skip to main content
To send marketing email, you verify a domain you own. Senderz then signs every message with a DKIM key that lives in AWS KMS and never leaves it.

​
Adding a domain

1

Add

Domains → Add domain. Enter the domain you send from — typically a subdomain like mail.yourstore.com.
2

Publish records

Senderz shows the records to add, grouped: authentication (SPF, DKIM), return-path, DMARC, and tracking (the track. CNAME).
3

Verify (automatic)

A background job checks DNS every minute. Once records resolve, the domain flips to Verified — no manual Verify click needed. The Verify button is a check-now convenience.

​
The records

SPF

Authorises Senderz’s infrastructure to send for your domain.

DKIM

A CNAME/TXT so receivers can verify the signature. The private key is in KMS.

DMARC

Your policy and aggregate reporting address.

Tracking

A track. CNAME for open/click tracking on your own domain.

​
DKIM lives in KMS

Your DKIM private key is generated in AWS KMS and never leaves it. Signing happens by calling KMS at the send worker — the application never holds the raw key. This is your domain’s reputation, protected at the infrastructure level.

​
DNS auto-configuration

If your DNS provider supports Domain Connect (including Cloudflare, Route 53 and others), Senderz can write the records for you. Click Auto-configure, approve in your DNS provider, and the records land in your account.
When auto-config isn’t available for your provider, Senderz degrades gracefully to showing the manual records to copy.

​
Verification stays fresh

The background sweep also re-checks already-verified domains. If a domain later loses its DNS records, it’s demoted — which immediately blocks sending, because every send path gates on verified status. Demotion is fail-safe: a transient DNS blip won’t false-demote. A verified→unverified transition alerts the workspace owner once; recovery alerts once more.

​
Removing a domain

Deleting a domain (owner/admin) is audit-logged. Removing your last domain schedules the per-tenant KMS DKIM key for deletion (a pending window) — best-effort and idempotent, and re-adding a domain recreates the key.

​
Sending identity per domain

Under each verified domain you manage the sender addresses (local parts) and a workspace-wide list of sender names. A verified domain authorises every local part on it — no per-address approval — because DKIM signs at the domain level. See Email.