# Domains

> Add a sending domain, publish its DNS records, and understand verification and domain status.

Every email you send comes from a verified domain. Verification proves you control the domain and lets mailbox providers authenticate your messages, which is essential for reaching the inbox.

## Use a subdomain

Add a subdomain dedicated to sending, such as `mail.example.com` or `notifications.example.com`. Root domains like `example.com` are not accepted.

A subdomain keeps your sending reputation separate from your company's everyday mail, and avoids conflicts with records your root domain already has, such as its MX or SPF records.

> [!TIP]
> Use a separate subdomain per purpose — for example `mail.example.com` for product email and `billing.example.com` for receipts — so one stream's reputation does not affect the other.

## DNS records

After you add a domain, its page lists the records to publish. Copy names and values exactly as shown; they are unique to your domain.

| Record | Type | Purpose |
| --- | --- | --- |
| DKIM | `CNAME` | Signs your messages so receivers can verify they came from you and were not changed. There are usually three, named `<token>._domainkey.mail.example.com`. |
| Bounce MX | `MX`, priority `10` | Routes bounces and complaints back to Nexiom Connect, on `nc-bounce.mail.example.com`. |
| SPF | `TXT` | Authorizes Nexiom Connect to send for the bounce domain, on `nc-bounce.mail.example.com`. |
| DMARC | `TXT` | Optional. Tells receivers how to treat mail that fails authentication, on `_dmarc.mail.example.com`. |

DKIM, bounce MX, and SPF are required for sending. DMARC is recommended but never blocks sending; the suggested starting policy is `v=DMARC1; p=none;`.

> [!NOTE]
> Some DNS providers append your domain to every record name automatically. If yours does, enter only the part before your domain — for example `nc-bounce.mail` instead of `nc-bounce.mail.example.com`. See [DNS provider setup](/docs/learn/dns-providers).

## Verification

Nexiom Connect checks pending domains automatically every 30 minutes, and you can select **Check status** in the dashboard or call [Verify a domain](/docs/api/email-domains/verify) after you publish records. Verified domains are re-checked periodically so a removed record is noticed.

| Domain status | Meaning |
| --- | --- |
| `pending` | Records have not been confirmed yet. DNS changes can take from a few minutes to 48 hours to propagate. |
| `verified` | The domain is ready to send. |
| `failed` | One or more required records could not be verified. Check each record's status and fix the values. |

Each DNS record also has its own status — `not_started`, `pending`, `verified`, `temporary_failure`, or `failed` — so you can see exactly which one needs attention. If a domain stays pending, follow [Domain not verifying](/docs/learn/domain-not-verifying).

## Test a domain

Once verified, send yourself a message with **Send test email** on the domain's page in the dashboard before sending to real recipients.

## Open tracking

Open tracking is on by default. It records when a recipient opens an email by including a tiny image. You can turn it off when you add the domain, for example for highly sensitive mail. Opens are a signal, not a guarantee: privacy features in some email clients load images automatically.

## Manage domains with the API

- [Create a domain](/docs/api/email-domains/create) Add a domain and receive its DNS records.
- [Retrieve a domain](/docs/api/email-domains/retrieve) Check verification and per-record status.
- [Send an email](/docs/api/emails/send) Send your first message from a verified domain.

---

Source: https://connect.nxiom.com/docs/learn/domains