# Domains and sender authentication

> A sending domain in MailCamp is a domain you have authenticated so that email sent from it is accepted by recipient mail servers. Authentication rests on three DNS mechanisms: SPF, DKIM and DMARC. It is configured from the sender emails page in settings.

## What it is

Modern mailbox providers (Gmail, Outlook, Yahoo, Apple Mail) reject or junk mail that is not authenticated. To send from `you@yourcompany.com`, MailCamp needs to prove it is authorised to do so, and that proof lives in DNS records under `yourcompany.com`.

Do not confuse this with **Websites** in settings, which whitelists a domain for embedding subscription forms. Sender authentication and form embedding are separate setups that may happen to use the same domain.

## Key concepts

- **Domain**: the part of a sender address after the `@`.
- **SPF (Sender Policy Framework)**: a TXT record at the root of the domain listing which servers may send on its behalf. A domain may have only one SPF record — merge the `include:` part into an existing record rather than adding a second one, or both fail.
- **DKIM (DomainKeys Identified Mail)**: a cryptographic signature on each outgoing message. MailCamp signs with a private key; the matching public keys are published as two CNAME records on selector subdomains, so keys can be rotated without you touching DNS again. DKIM survives forwarding, which SPF does not — that is why it is now the more important of the two.
- **DMARC (Domain-based Message Authentication, Reporting & Conformance)**: the policy layer. It tells receivers what to do with mail that fails SPF and DKIM (`p=none`, `p=quarantine`, `p=reject`) and requests aggregate reports about who is sending in your name.
- **Verification status**: each record is checked from the wizard. Until the checks pass, sending from that domain is restricted.
- **Sender email**: a specific address (e.g. `news@yourcompany.com`) under an authenticated domain. Each list and campaign uses one.

## Common workflows

### Authenticating a sending domain

1. Open **Settings → Sender emails** and open the domain you want to send from — the verification wizard shows the exact records.
2. Add the SPF TXT record at the root of the domain in your DNS provider.
3. Add both DKIM CNAME records on their selector subdomains (not on the root), exactly as the wizard shows them.
4. Wait for DNS to propagate — usually minutes, occasionally up to 24 hours — and re-run the verification until each check turns green.

### Rolling out DMARC safely

1. Start at `p=none`: monitoring and reporting only, no effect on delivery.
2. Read the aggregate reports for a few weeks to find every system that sends in your name, including ones you had forgotten.
3. Once all legitimate senders pass SPF or DKIM, move to `p=quarantine` — failures land in spam.
4. When nothing legitimate is being mis-flagged, move to `p=reject`.

Going straight to `p=reject` can block mail from systems you overlooked (HR notifications, invoicing, ticketing). The staged rollout exists to surface those first.

### Adding a sender address

1. Open **Settings → Sender emails** and add the address.
2. Confirm the verification email MailCamp sends to it.
3. The address is now selectable as `from` or `reply-to` on lists and campaigns.

## Limits and edge cases

- Since 2024, Gmail and Yahoo require a DMARC record for anyone sending more than 5,000 messages a day; without one, campaigns are rejected outright. Even small senders should publish at least `p=none`.
- DKIM verification needs *both* CNAME records; a single missing or mistyped record fails the check.
- A stray space or wrong selector host name is the usual cause of a verification that keeps failing after the records were added.
- Removing an authenticated domain disables every sender address under it.
- A free address (gmail.com, hotmail.com) as sender is rejected or filed as spam by many providers — always send from your own authenticated domain.

## Web routes

Paths use `:id` as the placeholder.

- `/settings/emails` — sender addresses and the domain verification wizard.
- `/settings/emails/new` — add a sender address.
- `/settings/emails/:id/update` — edit a sender address.

## Related

- [Mailing lists](/llms/mailing-lists.txt) — where a sender identity is chosen.
- [Campaigns](/llms/campaigns.txt) — cannot send without a verified sender.
- [Websites](/llms/websites.txt) — domain verification for embedding forms, a different mechanism.