# Sending domains

Authenticate your sender with DKIM, custom MAIL FROM and a clear DNS verification workflow.

Source: https://docs.ravenrelay.joshlab.site/domains

Agent index: https://docs.ravenrelay.joshlab.site/llms.txt
OpenAPI: https://docs.ravenrelay.joshlab.site/openapi.json

## Add a domain

Add a domain you control in the project's Domains screen. Enter a DNS name without a protocol, path or email address. RavenRelay provisions the sending identity in the configured delivery region and displays its DNS records.

> Use the exact records generated for your domain. The examples below illustrate record shapes; they are not valid verification tokens.

## Publish the DNS records

| Purpose | Type | Host / value |
| --- | --- | --- |
| DKIM | 3 × CNAME | <token>._domainkey.example.com → <token>.dkim.amazonses.com |
| MAIL FROM | MX | raven.example.com → feedback-smtp.<region>.amazonses.com (priority 10) |
| SPF | TXT | raven.example.com → v=spf1 include:amazonses.com ~all |

DNS providers may append your domain automatically. If yours does, enter only the relative host. Disable proxying for DKIM CNAMEs. Copy the DNS targets exactly as shown; changing them prevents authentication.

MAIL FROM always uses raven.<sending-domain>. This keeps it separate from your normal mailbox host. Use the delivery region displayed in the dashboard.

## Understand DMARC

RavenRelay checks TXT records at _dmarc.<sending-domain>. Missing means a DMARC record was not detected at that name. On a subdomain, the current checker does not evaluate inherited organizational-domain policies.

Example monitoring policy

```
Type: TXT
Host: _dmarc.example.com
Value: v=DMARC1; p=none;
```

Review any existing policy before changing it. DMARC detection is separate from identity, DKIM and MAIL FROM readiness; a missing DMARC record does not itself block sending.

## Verification troubleshooting

1. Check the full host name for an accidentally duplicated domain suffix.
2. Allow DNS propagation, then refresh verification.
3. Confirm DKIM CNAMEs are DNS-only and MX priority is 10.
4. If Domain setup failed, retry verification after the operator checks backend credentials, region and provider permissions.

An existing sending identity is not a reason to delete a working provider identity. An operator should inspect provisioning errors before changing resources.