Skip to main content

Sending Domains

A sending domain is the domain in the From address of every message you send through Mailtarget. Before the platform delivers from your domain, three DNS records have to authorize Mailtarget to send on its behalf.

This page covers the records, the verification flow, and the DNS gotchas that cause most first-time failures.

The three records​

Every Mailtarget sending domain needs:

  1. SPF (TXT record) that includes Mailtarget in the authorized senders list for the domain.
  2. DKIM (TXT record on a Mailtarget-issued selector) that signs outbound messages so receivers can verify the message has not been tampered with.
  3. Tracking domain (CNAME record on a subdomain) that points to Mailtarget so click and open tracking links resolve under your domain instead of the platform default.

DMARC is optional but expected for any production sending domain. Read the Operations section for the policy progression.

Verification flow​

The flow inside the dashboard is the same shape every time:

  1. Add the sending domain (for example, mail.yourcompany.com).
  2. Mailtarget shows you the exact records to publish at your DNS provider.
  3. Publish the records at the provider.
  4. Click Verify in the dashboard. Mailtarget queries DNS and flips the status to Verified when all three records resolve correctly.
  5. The first send is allowed only after the domain is verified.

Most providers propagate within minutes. Some legacy providers can take up to 24 hours. If verification fails, the dashboard tells you which record is missing or wrong.

Subdomain vs apex​

Use a subdomain for sending. mail.yourcompany.com, notifications.yourcompany.com, or transactional.yourcompany.com are typical.

Sending from the apex (yourcompany.com) is supported but discouraged for two reasons:

  • The apex is also the domain that receives email, runs your website, and serves marketing content. Mixing roles makes it hard to isolate a deliverability problem.
  • DMARC policy at the apex affects every subdomain unless you publish per-subdomain overrides. A strict apex DMARC will quarantine messages from the wrong sender even if Mailtarget is correctly configured.

Use the subdomain. Keep the apex for the website and inbound mail.

DNS provider gotchas​

The most common verification failures come from the DNS provider, not from Mailtarget.

  • Cloudflare proxying. Cloudflare proxies CNAME records by default. The tracking domain CNAME must be set to DNS only (gray cloud), not proxied.
  • Auto-flatten of CNAMEs at apex. If you sent at the apex (which you should not), some providers flatten apex CNAMEs to A records. The flatten breaks tracking domain resolution. Use a subdomain.
  • Multiple SPF records. A domain can publish only one SPF TXT record. Some teams publish a second record by accident when they add Mailtarget alongside another provider. Merge them into one record with both include: mechanisms.
  • SPF lookup limit. SPF allows ten DNS lookups. Each include: counts. Domains with five or more email vendors hit this limit and quietly fail. Audit the chain.
  • DKIM TXT length. DKIM keys are long. Some DNS providers truncate TXT records at 255 characters. The key must be split into quoted strings inside one record, not multiple records.
  • Indonesian DNS providers. Niagahoster, Rumahweb, IDwebhost, and similar providers sometimes restrict TXT record length or strip underscores from labels. If verification fails on those providers, contact their support and ask for the exact record to be published as-is, with no transformation.

If the dashboard verification fails after these checks, copy the record from the dashboard, paste it into a terminal dig command, and confirm it resolves end to end before opening a support ticket.

dig +short TXT <selector>._domainkey.<your-sending-domain>

What changes when the domain is verified​

After verification:

  • Outbound messages from the domain are signed with DKIM.
  • Click and open tracking links use the tracking subdomain instead of the platform default.
  • The domain reputation begins to accrue with mailbox providers.

Domain reputation takes weeks to build. Send consistently, keep complaint rates low, and avoid sending to lists you have not collected with proper consent. Read the Operations section for the long-term posture.

Next​

Before you wire production retries, read Errors and Rate Limits. Bounce handling depends on understanding the difference between hard bounces, soft bounces, and rate limits.