Onboards a sending domain: the gap between "mail refuses" and "mail works".
A sending subdomain is zone-scoped (/zones/{zone}/email/sending/subdomains; the account path
answers Unable to authenticate request, which reads like a bad token). Its six records (three
MX, SPF, DKIM, DMARC) are diffed by dnsPlan(). Destination verification stays manual (a clicked
link proves inbox control) but can be polled via status or the verified timestamp. Needs zone
DNS write, so it is an opt-in surface, not part of the first-run claim.
Onboards a sending domain: the gap between "mail refuses" and "mail works".
A sending subdomain is zone-scoped (
/zones/{zone}/email/sending/subdomains; the account path answersUnable to authenticate request, which reads like a bad token). Its six records (three MX, SPF, DKIM, DMARC) are diffed bydnsPlan(). Destination verification stays manual (a clicked link proves inbox control) but can be polled viastatusor theverifiedtimestamp. Needs zone DNS write, so it is an opt-in surface, not part of the first-run claim.