Verify your sending domain
Verify a domain in Samva so you can send email from your own address. Add the domain, publish the DNS records Samva provides, and confirm verification.
Before you can send email from your own address, the sending domain must be verified in Samva. Verification proves you own the domain and lets Samva sign your mail with DKIM so receiving servers can authenticate it. This guide takes you from adding a domain to a verified status.
New accounts can start sending right away on a Samva-provided domain. To send from your own address, verify the domain first.
Before you start
You need:
- A Samva account and access to your workspace's dashboard.
- A domain you control, with access to its DNS settings (at your registrar or DNS host).
1. Add your domain
- In the dashboard, go to Email → Domains.
- Choose to add a domain and enter the domain you want to send from (for example,
yourdomain.com). - Save it. Samva creates the domain record and generates the DNS records you'll publish next.
2. Publish the DNS records
Samva returns a set of DNS records for the domain. If Cloudflare or Vercel manages the authoritative zone, use automatic DNS setup to connect the provider, review an exact plan, and apply it. For manual setup, choose your DNS provider guide and add each record from the dashboard.
You'll typically see:
- A TXT record for DKIM, which verifies domain ownership and lets Samva cryptographically sign your outgoing mail.
- MX and TXT (SPF) records for
mail.yourdomain.com, the custom return path used for bounce handling and SPF alignment. Reserve this subdomain for Samva's return path; it is not an inbox or the address recipients see in the From header.
A DMARC policy is a separate, recommended step. The DMARC row of the authentication card shows the policy the world sees, including one inherited from the organizational domain, and links to the guide when none is set. DMARC never blocks Samva verification, and Samva never creates or replaces the record. Follow email authentication to review your policy.
Copy the host and value for each record from the dashboard rather than retyping them. The exact names and values are specific to your domain. To learn what each record does and why it matters for inbox placement, see Deliverability.
The DKIM record's value runs longer than 255 characters. Most DNS hosts accept it as one entry and store it correctly. If yours rejects it as too long, split the value into 255-character segments; DNS reassembles them into a single record.
3. Wait for verification
DNS changes take time to propagate, often minutes, sometimes up to a few hours, depending on your provider. Samva checks for the records and updates the domain's status once it detects them.
You don't need to keep the page open. Come back to Email → Domains to check progress.
4. Confirm the status
- Return to Email → Domains.
- Select your domain, choose Check now below the records when available, and wait for Ready to send.
Once the domain is verified, you can use any address on it as a sender. The overview says Ready to send only when the domain, the workspace, and the provider all permit it; a verified domain does not override a sending pause.
If the domain hasn't verified after a few hours, double-check that each DNS record's host and value match the dashboard exactly, with no extra characters or trailing dots added by your DNS host. Then wait for the next check.
If a verified domain becomes degraded
Samva keeps checking DNS and provider verification after a domain is ready. The domain overview shows one status and, when the next move is yours, one instruction:
- Needs attention: a required DNS record is missing or no longer matches. Publish or correct the record marked in the table, then select Check now.
- Repairing or Email setup in progress: Samva or the provider is working. There is nothing to do. Keep the published records in place; removing and re-adding the domain is not a recovery step.
- Under review: support is resolving signing-key custody or ownership. You will hear from us.
- Sending paused: the domain is verified, but sending is paused for the workspace. The banner at the top of the dashboard explains why. Checking DNS does not resume paused sending.
A ready domain whose last reading is old shows Rechecking until Samva has read it again. Hover the line under the DNS records for the exact times of the last and next check and what the provider reported. If the custom return path fails verification, Samva does not fall back to a shared return path. Readiness returns after the required DNS, DKIM, and return-path checks succeed.
Subscribe to domain.updated to receive verification phase changes, including degradation and
recovery, through webhooks.
Rotate a DKIM signing key
- Open a ready domain and select Rotate key on the DKIM row of the authentication card, then Prepare new key.
- A new TXT record tagged New key appears in the DNS table. Publish it beside the current record. The current key keeps signing while the new record propagates.
- Select Check now. Samva activates the new key only after observing its public DNS record, then checks signing and return-path readiness. Reopening the page shows the saved rotation.
- After the switch, the former record stays in the table tagged Keep published. Delayed and forwarded messages signed with the former key still verify against it. Hover the tag for the earliest date it could be retired; that date is not a deletion instruction, and Samva never removes the record for you. See email authentication for how retirement is decided.
For CLI automation, run samva email domains rotate-dkim <domain-id> --idempotency-key <unique-key>.
Reuse that key when retrying the same request. The response contains the new record, former record,
and minimum retention horizon. Use the normal domain check after publishing the new record.