Create a key to copy examples filled with your team.
Verified domains
DKIM and return-path must verify before send.
A sending domain is the host you put in From. PostShiba issues a DKIM keypair and two CNAME hosts on create. Send stays blocked until DKIM and return-path both verify.
What verified means
A domain is verified when DKIM and return-path are both verified. SPF is checked and stored. It is not required. A suspended domain or tenant cannot send even when DNS still passes.
| Record | Host | Value |
|---|---|---|
| DKIM CNAME | {selector}._domainkey.{name} |
{team_id}-{domain_id}.{dkim_zone} |
| Return-path CNAME | rp.{name} |
The PostShiba return-path zone |
| SPF TXT | {name} |
v=spf1 include:{spf_include} ~all |
Default selector is s1. For mail.example.com that is s1._domainkey.mail.example.com and rp.mail.example.com.
There is no DMARC product UI. Publish a DMARC TXT on your side if you want one.
The first domain on the account becomes the primary. Every outbound message is DKIM-signed with the From domain, then signed again with the primary when those names differ. The second signature is d={primary}. DMARC alignment still comes from the From-domain signature. Return-path stays rp.{from-domain}. Make primary on another verified domain to change which key is the second signer.