Skip to content
Mailack
esBook a demo
Docs · Domains

Sending domains.

Register the domain you send from, publish the TXT challenge record and verify it before using it in From.

  1. 01why

    Sender control

    Once a tenant has at least one verified domain, every message From must match a verified domain. Otherwise the API returns domain_not_verified and the message never enters the evidence chain.

    pendingverifieddomain_not_verified
  2. 02POST /v1/domains

    Register the domain

    Creates the domain in pending status. The response includes the verification token and DNS hints (challenge_host, challenge_value, dkim_host, spf_hint).

    POST /v1/domains
    curl -s -X POST "$MAILACK_API_URL/v1/domains" \
  -H "Authorization: Bearer $MAILACK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"mail.acme.mx"}' | jq .
  3. 03DNS

    Publish the TXT challenge

    In the domain's DNS zone, publish a TXT record at challenge_host with value challenge_value. Wait until it is visible from the public Internet.

    typeTXT
    hostchallenge_host (from create response)
    valuechallenge_value

    You can also do this in the client portal: Domains → create → copy records → Verify.

  4. 04POST /v1/domains/{id}/verify

    Verify

    Mailack queries DNS and, if the TXT matches, marks the domain verified. Retry if propagation is incomplete.

    POST /v1/domains/{id}/verify
    curl -s -X POST "$MAILACK_API_URL/v1/domains/$DOMAIN_ID/verify" \
  -H "Authorization: Bearer $MAILACK_API_KEY" | jq .
  5. 05DNS · signing

    “Falta DKIM”: the domain is yours, but it is not signing yet

    Verification proves ownership; DKIM signs every message. If the portal shows “Falta DKIM” (missing DKIM), the domain is verified but its signing record is not published: mail still goes out, but without an aligned signature and with a higher chance of landing in spam. To fix it, publish the DKIM record shown in the portal (Domains → your domain → DNS records) and click “Comprobar DKIM”.

    verifiedFalta DKIM
    typedkim_record_type (usually CNAME)
    hostdkim_host
    valuedkim_value

    Copy the host and value exactly as shown, adding and removing nothing. Propagation takes anywhere from minutes to a few hours; afterwards, “Comprobar DKIM” confirms the domain is signing.

  6. 06scopes

    Authentication

    Machine routes use a Bearer API key. Create and verify need messages:send; list needs evidence:read. Portal equivalents: /v1/portal/domains.

    messages:sendevidence:read

Next: webhooks

Once the domain is verified, connect HTTPS endpoints to receive the message lifecycle.

Webhooks guide