Custom Sending Domains & DKIM

Deliver emails directly from your own domain (e.g. [email protected] or [email protected]) with full cryptographic authentication to maximize inbox placement.

1. Why Custom Domains Matter

Sending from your own domain:

1. Elevates Brand Trust: Recipients see your exact domain in their mail client rather than a shared relay address.
2. Prevents Spam Classifications: SPF and DKIM authentication ensure major mailbox providers (Gmail, Outlook, Yahoo) recognize GNS as an authorized sender for your domain.
3. Domain Isolation: Your sender reputation is completely protected from other tenants.

2. Interactive DNS Record Calculator

Use the tool below to see the DNS entries your provider (Cloudflare, Route53, GoDaddy) needs. The Return-Path, SPF and DMARC records are the same for everyone. The DKIM selector and public key are unique to each domain, so copy the DKIM record from the Domains page in the Console; the DKIM row below only shows its shape:

3. The 3-Step Verification Process

Step 1: Register the Domain in Sendrin

In the Sendrin Console, navigate to Domains and click Add Domain. Enter your domain name (e.g. acme.com or notify.acme.com).

Step 2: Add DNS Records

When you register a domain, the Sendrin Console generates 4 tailored DNS records matching your dedicated RSA-2048 keypair:

1. TXT DKIM Record: Published at <selector>._domainkey.<domain> (e.g. postal-xxxxxx._domainkey.acme.com) containing your domain's unique RSA-2048 public key (v=DKIM1; k=rsa; p=...).
2. CNAME Return-Path Record: Published at psrp.<domain> pointing to psrp.iitdeveloper.com for automated bounce and delivery telemetry.
3. TXT SPF Alignment: Published at <domain> with v=spf1 include:spf.iitdeveloper.com ~all authorizing our Postal SMTP delivery cluster.
4. TXT DMARC Policy: Published at _dmarc.<domain> with v=DMARC1; p=none; sp=none; protecting your brand against spoofing.

Step 3: Trigger Verification

Click Verify DNS in the console or call the verification endpoint:

POST /api/v1/domains/{domain_id}/verify
Authorization: Bearer <keycloak_token>

{
  "domain": "acme.com",
  "status": "active",
  "dkim_status": "verified",
  "return_path_status": "verified",
  "spf_status": "verified",
  "dmarc_status": "verified",
  "verified_at": "2026-09-13T12:30:00Z"
}

[!IMPORTANT] Once verified, all outbound emails for applications bound to this domain will automatically sign DKIM headers with RSA-2048 keys.