Domains and DKIM
Add a sending domain, publish its DNS records and verify it.
A domain is an SES identity. Creating one returns the DNS records you publish.
curl -X POST "$SESAMESEND_URL/domains" \
-H "Authorization: Bearer $OPENSEND_API_KEY" -H "Content-Type: application/json" \
-d '{"name":"mail.example.com"}'Or add it in the dashboard. The region must be us-east-1: other regions are rejected.
Records
| Record | Type | Name | Value |
|---|---|---|---|
| SPF | MX | send (the return-path subdomain) | feedback-smtp.us-east-1.amazonses.com, priority 10 |
| SPF | TXT | send | v=spf1 include:amazonses.com ~all |
| DKIM | CNAME | <token>._domainkey, three of them | <token>.dkim.amazonses.com |
| Receiving | MX | @, only when receiving is on | inbound-smtp.us-east-1.amazonaws.com, priority 10 |
| Tracking | CNAME | your tracking_subdomain, only when set | the tracking target |
custom_return_path changes the send label. Use the exact names and values the API returns for your domain.
Verify
Publish the records, then:
curl -X POST "$SESAMESEND_URL/domains/<domain_id>/verify" -H "Authorization: Bearer $OPENSEND_API_KEY"Verification reads live state from SES (DKIM and the MAIL FROM check) and from DNS (tracking and receiving). DNS can take minutes to propagate; verify again. Status is one of not_started, pending, partially_verified, partially_failed, verified or failed.
Options
open_trackingandclick_tracking, both off by default. Click links arehttp://unless you set up HTTPS click tracking.tls:opportunistic(default) orenforced.capabilities:sending(on by default) andreceiving(off). Turn receiving on for inbound mail.
Domain claims
POST /domains/claim and its two companion routes let a team take over a domain another team registered. These three routes have not yet returned a 2xx to a real request on the reference instance, so treat them as unverified.
Sandbox
Until SES production access is granted, only verified addresses receive mail.