Definition
Email domain verification is the process of proving that a sender controls a particular domain before an email service provider will send mail from it. The sender is asked to add a record to the domain's DNS, and the provider confirms the record exists. Verification is a prerequisite for configuring SPF, DKIM, and other sending features, and it prevents abuse by stopping people from sending mail on domains they do not own.
How It Works
Most platforms verify ownership using one of a few DNS-based methods:
| Method | Record type | How it works |
|---|---|---|
| TXT verification | TXT | The provider issues a unique token; the sender adds it as a TXT record |
| CNAME verification | CNAME | The sender points a subdomain at a provider-owned hostname |
| Email verification | The provider sends a confirmation link to an address at the domain | |
| File verification | HTTP | The sender uploads a file to the domain's website |
The TXT token method is the most common. The sender adds a record such as example.com TXT "provider-verification=abc123", and the provider periodically checks DNS until it finds the match. Once verified, the domain is associated with the sender's account.
Why It Matters
Verification is the foundation of trustworthy sending. It ensures the domain in the From: address genuinely belongs to the sender, which underpins the entire email authentication stack. Without verification, a platform cannot safely sign mail with your domain or publish authentication records on your behalf.
Domain verification also enables:
- Custom DKIM signing under the sender's own domain, which is required for DMARC alignment.
- Return-path customisation for bounce handling.
- Subdomain separation, allowing marketing and transactional streams to be isolated.
Verification should not be confused with authentication records themselves. Verification proves ownership to the platform; SPF, DKIM, and DMARC then authenticate the mail to receiving servers.
Example
A company signs up with a new ESP and is asked to verify example.com. It adds the provider's TXT token to its DNS, and the platform confirms control within minutes. The company then configures DKIM signing under example.com, and its campaigns authenticate correctly at receiving servers.
Was this useful?
Related Glossary Terms
BIMI
BIMI (Brand Indicators for Message Identification) is an email standard that allows brands to display their logo next to their emails in supported email clients. It requires DMARC enforcement at quarantine or reject policy.
Email Deliverability
Email deliverability is the ability to land in the recipient's inbox rather than the spam folder. It depends on sender reputation, authentication, list quality, and content practices.
DKIM Alignment
DKIM alignment is the DMARC requirement that the domain in the From header matches the domain in the DKIM signature, confirming the visible sender domain is authenticated.
DKIM (DomainKeys Identified Mail)
DKIM (DomainKeys Identified Mail) is an email authentication method that uses digital signatures to verify that an email was not tampered with during transit and comes from a authorised domain.
DMARC Aggregate Report
A DMARC aggregate report is a machine-readable XML summary that receiving mail servers send to domain owners daily to show authentication results for their email traffic.
DMARC Forensic Report
A DMARC forensic report is a detailed message-level copy of an individual email that failed DMARC authentication, sent to the domain owner to help diagnose spoofing and misconfiguration.
Frequently Asked Questions
No. Verification proves to the sending platform that you own the domain. DKIM is a separate record that cryptographically signs outgoing mail. Verification is usually required before DKIM can be set up.
It depends on DNS propagation, but it is often completed within minutes. Some providers check immediately after the record is saved, while others may take up to a day if DNS TTL values are long.
Each domain or subdomain you send from typically needs its own verification, because DNS records are specific to a name. Verifying subdomains also lets you isolate sending reputation between streams.
If the verification record is removed, the platform may stop sending on that domain, because it can no longer confirm control. Keep verification records in place for as long as the domain is in active use.