Verify a sending domain

Mailbox providers trust mail that your domain has authorised. Verify each domain you send from.

What you need first

• A domain you own, with access to its DNS.

• A connected provider (see Connect a sending provider). Connect it first: the SPF include and DKIM selectors Hermeticor suggests follow your email connections.

1. Add the domain

curl -s -X POST "$BASE/v1/sending-domains" \
  -H "Authorization: Bearer $HERMETICA_API_KEY" -H "Content-Type: application/json" \
  -H "Idempotency-Key: domain-mail-example" \
  -d '{"domain":"mail.example.com"}'

2. Publish the records at your DNS host

The answer (and GET /v1/sending-domains/<domainId>) carries records, the DNS records still to publish:

"records": [
  { "purpose": "ownership", "type": "TXT", "name": "_hermetica.mail.example.com", "value": "hermetica-verification=…", "source": "hermetica" },
  { "purpose": "spf", "type": "TXT", "name": "mail.example.com", "value": "v=spf1 include:sendgrid.net ~all", "source": "hermetica" },
  { "purpose": "dkim", "type": "CNAME", "name": "s1._domainkey.mail.example.com", "value": null, "source": "provider", "note": "…" },
  { "purpose": "dmarc", "type": "TXT", "name": "_dmarc.mail.example.com", "value": "v=DMARC1; p=none", "source": "hermetica" }
]

• Ownership: the _hermetica TXT record proves this workspace controls the domain. Keep it published.

• SPF: one TXT record on the domain. When the domain already has an SPF record, the suggested value is that record with the missing includes added, so replace it rather than adding a second one.

• DKIM: your provider issues the key, so value is null (source: "provider"). Copy it from the provider's domain settings for the selector named in name.

• DMARC: a monitoring-only starter. Move to p=quarantine once SPF and DKIM pass.

Records disappear from the list once their check passes; the ownership record always stays.

3. Check

curl -s -X POST "$BASE/v1/sending-domains/<domainId>/check" -H "Authorization: Bearer $HERMETICA_API_KEY"

The answer shows spf, dkim, dmarc and mx results and the remaining records. When the ownership record is found and SPF and DKIM pass, verified is true and senders on that domain are verified. Without the ownership record it stays unverified, even if SPF and DKIM pass. A domain that publishes "send no mail" (an SPF with no allowed senders, or a null MX) fails the check.

DNS can take a while to spread. Run the check again after you change records.

4. Choose tracking per domain

curl -s -X PATCH "$BASE/v1/sending-domains/<domainId>" \
  -H "Authorization: Bearer $HERMETICA_API_KEY" -H "Content-Type: application/json" \
  -d '{"openTracking":false,"clickTracking":true}'

5. Optional: a tracking domain

Branded click links look better and are trusted more.

curl -s -X POST "$BASE/v1/tracking-domains" \
  -H "Authorization: Bearer $HERMETICA_API_KEY" -H "Content-Type: application/json" \
  -d '{"domain":"track.example.com"}'
# answer includes cnameTarget

Add a CNAME from track.example.com to the cnameTarget, then call POST /v1/tracking-domains/<id>/verify. It answers 202 and checks in the background.

Check your setup

curl -s "$BASE/v1/deliverability/domain-standards?domain=mail.example.com" -H "Authorization: Bearer $HERMETICA_API_KEY"

This reports BIMI, MTA-STS and TLS-RPT for the domain.

Next: Import your contacts.