# Verify sending domains with DKIM, SPF and staged DMARC

> Add a domain and Minket lists the records to publish, checks them, and shows what fails and why.

Canonical: https://minket.com/domains. Updated: 2026-10-28.

*A domain's page in the console.* The seal of mail.fernbank.example with five of its six sending records verified and the SPF record on the bounce host failing, so live mail waits. Fixing the record and pressing Check DNS closes the ring.

## Checked every hour until they verify

Then every 6 hours, and test keys keep working while a record fails.

**The answer to live mail from a failing domain**

```http
403 domain_authentication_failed
SPF, DKIM or DMARC is failing for this domain. Sending resumes when DNS is fixed.
```

## DMARC is staged by a person

It tightens one step at a time, and only while the domain passes.

**The three stages**

- `p=none` (where a new domain starts): Receivers report; nothing is filtered.
- `p=quarantine`: Mail that fails goes to spam.
- `p=reject`: Mail that fails is refused.

## Cloudflare writes the records it showed you

With a Cloudflare token the console lists what it would write, writes it, and never changes a record it did not create.

**The plan before Write 5 records**

| Record | Type | Plan |
| --- | --- | --- |
| DKIM | 3 `CNAME` | create |
| MAIL FROM | `MX` | create |
| SPF | `TXT` | create |
| DMARC | `TXT` | already in place |

## Reports, Postmaster, seed tests and BIMI

- **[Aggregate reports](https://docs.minket.com/dmarc/)**: Reports sent to `dmarc@` become the domain's 30-day pass rate.
- **[Postmaster](https://docs.minket.com/deliverability/)**: Gmail's view of the domain, once it sends a few hundred messages a day to Gmail.
- **[Seed tests](https://docs.minket.com/deliverability/)**: Inbox placement checked every 7 days across up to 10 seed inboxes.
- **[BIMI](https://docs.minket.com/domains/)**: Your logo in the inboxes that show one, from `p=quarantine` up.

## Questions

### Do subdomains work?

Yes: `mail.fernbank.example` gets its own records and checks, apart from `fernbank.example`.

### Do I need Cloudflare?

No. Publish the records at any DNS host; the token only saves the copying.

### How many domains per project?

Up to 50.

More: Read the domains guide, https://docs.minket.com/domains/