How verification works
Sending email from your own domain requires proving ownership and authenticating your mail. Onchain Suite provisions your domain and gives you five DNS records to add at your DNS provider:
A domain is send-ready when Ownership, SPF, and both DKIM records verify. Ownership alone is not enough.
The flow
- Register —
POST /domainwith your domain. The response includes the completednsrecord set immediately, so you can add everything in one DNS session. - Add the records at your DNS provider.
- Verify —
POST /domain/{id}/verify, or watchGET /domain/{id}/dnsupdate live as records propagate. - Done — on completion your
noreply@yourdomainsender is created automatically and campaigns can send from your domain.
Live status for every record
GET /domain/{id}/dns returns each record with its live verification state:
Conflict detection — when a record “won’t verify”
Most stuck verifications aren’t missing records — they’re clashes with records that already exist. Onchain Suite checks your live DNS and tells you exactly what to change:- Two SPF records — multiple
v=spf1records make SPF fail entirely. We compute the exact merged record to publish, tell you which record to keep and edit, and name the specific record(s) to delete — everything else in your DNS is left alone. - Existing SPF without our include — never add a second SPF record; we return the merged value to edit into your existing one.
- DKIM name occupied — a previous email provider’s CNAME (edit it to our value) or an old TXT key squatting the selector name (delete only that TXT, then add the CNAME).
- Existing DMARC — informational only; your existing policy is fine.
Tips
- Your registrar may show the host as
selector1._domainkeyorselector1._domainkey.yourdomain.com— both are the same record. - SPF and Ownership both live at
@(the domain root) as TXT records — they coexist fine; only a secondv=spf1record is a problem. - DNS changes usually propagate in minutes but can take up to an hour depending on your provider’s TTL.

