Sender domains

Verify a domain before sending from it. Verification confirms your workspace controls the domain and sets up DKIM signing to authenticate your emails.

Domain management requires a Personal Access Token (unlayer_pat_*) belonging to a workspace owner or admin. Because a PAT is not bound to a project, pass a project in that workspace with X-Project-Id on every domain request. Project API keys can send mail but cannot inspect or change workspace-shared sender domains.

Use a subdomain

Send from a dedicated subdomain like mail.example.com instead of your root domain. It keeps your transactional reputation separate from the rest of your mail.

1. Register the domain

curl -X POST https://api.unlayer.com/v3/domains \
  -H "Authorization: Bearer unlayer_pat_xxx" \
  -H "X-Project-Id: 12345" \
  -H "Content-Type: application/json" \
  -d '{ "domain": "mail.example.com" }'

The response returns the workspace domain id, an ownership challenge, and the DKIM tokens. To get the complete set of DNS records to publish, fetch the domain detail (next step).

If registration returns a 5xx, list your domains before retrying. If the domain is already listed, inspect its status and DNS records. Contact support if it cannot be verified.

If a previously registered domain returns a conflict because provider verification failed, contact Unlayer support to restart verification.

2. Publish the DNS records

Fetch the domain to get both required record types: a workspace-specific ownership TXT record and the SES DKIM CNAME records:

curl https://api.unlayer.com/v3/domains/42 \
  -H "Authorization: Bearer unlayer_pat_xxx" \
  -H "X-Project-Id: 12345"

{
  "data": {
    "id": 42,
    "domain": "mail.example.com",
    "status": "pending",
    "dkimTokens": ["abc123", "def456", "ghi789"],
    "dnsRecords": [
      {
        "type": "TXT",
        "name": "_unlayer-verification.mail.example.com",
        "value": "6d4474...workspace-specific-token",
        "purpose": "Unlayer ownership"
      },
      {
        "type": "CNAME",
        "name": "abc123._domainkey.mail.example.com",
        "value": "abc123.dkim.amazonses.com",
        "purpose": "DKIM"
      },
      {
        "type": "CNAME",
        "name": "def456._domainkey.mail.example.com",
        "value": "def456.dkim.amazonses.com",
        "purpose": "DKIM"
      },
      {
        "type": "CNAME",
        "name": "ghi789._domainkey.mail.example.com",
        "value": "ghi789.dkim.amazonses.com",
        "purpose": "DKIM"
      }
    ],
    "createdAt": "2026-06-18T12:00:00.000Z"
  }
}

Add every dnsRecords entry (one ownership TXT and the DKIM CNAMEs) at your DNS provider exactly as returned. On Cloudflare, set CNAMEs to DNS only (grey cloud), not Proxied. Propagation usually takes minutes, sometimes a few hours.

In Console, Settings → Domains displays this same complete record set. Its Copy All action includes the ownership TXT record and every DKIM CNAME.

Both checks are required

The TXT challenge proves that this Unlayer workspace controls the domain. DKIM authenticates mail sent through SES. The domain becomes verified only after both checks succeed. SPF and DMARC remain optional hardening (see below).

SPF and DMARC

Publish the DNS records returned by Unlayer. You do not need to change your existing SPF record for this setup: the default sending configuration handles SPF, and DKIM provides authentication aligned with your sender domain.

DMARC is optional for Unlayer verification. If you add it, start with p=none to monitor your mail before choosing a stricter policy. Existing DMARC policies affect all mail using the domain, so check other sending services before making changes.

3. Verify

Once the records propagate, check verification:

curl -X POST https://api.unlayer.com/v3/domains/42/verify \
  -H "Authorization: Bearer unlayer_pat_xxx" \
  -H "X-Project-Id: 12345"

{
  "data": {
    "id": 42,
    "domain": "mail.example.com",
    "status": "verified",
    "ownership": { "verified": true },
    "dkim": { "status": "SUCCESS", "tokens": ["abc123", "def456"] }
  }
}

The Console's Verify action reports whether verification succeeded, remains pending, or failed. A pending result means the ownership TXT or at least one DKIM record has not propagated.

When status is verified, you can send from any address on that domain (for example, hello@mail.example.com).

If the status becomes failed, check the DNS records and contact Unlayer support to restart verification.

Verified domains are available to every project in their workspace. A domain can be verified for only one workspace at a time; a conflicting verification returns 409.

Manage domains

List every registered domain and its status:

curl https://api.unlayer.com/v3/domains \
  -H "Authorization: Bearer unlayer_pat_xxx" \
  -H "X-Project-Id: 12345"

Remove a domain

curl -X DELETE https://api.unlayer.com/v3/domains/42 \
  -H "Authorization: Bearer unlayer_pat_xxx" \
  -H "X-Project-Id: 12345"

After removal, projects in the workspace can no longer send from the domain.

Verification statuses

`status`	Meaning
`pending`	Ownership TXT or DKIM is not yet confirmed. Publish all records, then verify.
`verified`	Workspace ownership and DKIM are confirmed. You can send from this domain.
`failed`	SES stopped the DKIM attempt. Contact Unlayer support to restart it.

Domain verified? Head to Sending emails.

1. Register the domain​

2. Publish the DNS records​

SPF and DMARC​

3. Verify​

Manage domains​

Remove a domain​

Verification statuses​

Next​