# Production checklist

> Confirm your domain, keys, error handling, and monitoring before you send to real users.

Work through this list before you go live.

## Domain

- [ ] Your sending subdomain shows **Verified**, with DKIM, SPF, and bounce MX records verified.
- [ ] A DMARC record is published for the subdomain.
- [ ] You sent a test email and it reached the inbox, not spam.
- [ ] Production and staging send from different subdomains, such as `mail.example.com` and `mail.staging.example.com`.

## API keys

- [ ] Production uses its own API key, separate from development and staging.
- [ ] Application servers use **Email send only** keys, restricted to their sending domain.
- [ ] Keys are stored in a secret manager or environment variables — never in code, logs, or the browser.
- [ ] You know how to [rotate a key](/docs/learn/api-keys#rotate-a-key) quickly.

## Sending

- [ ] Every send uses an [idempotency key](/docs/learn/retry-safely) derived from the triggering event.
- [ ] Transient failures are retried with backoff; validation and permission errors are logged and alerted on.
- [ ] Emails are sent from background jobs, not inside user-facing requests.
- [ ] Messages include a plain-text version and a `replyTo` address that someone reads.

## Monitoring

- [ ] A [webhook](/docs/webhooks) receives at least `email.bounced`, `email.complained`, and `email.failed`.
- [ ] The webhook receiver [verifies signatures](/docs/webhooks/verify-webhooks-requests) and stores events before acknowledging them.
- [ ] Someone is alerted when bounce or complaint rates rise. See [Deliverability](/docs/learn/deliverability).
- [ ] You log each request's `correlationId` from error responses, for faster support.

## Limits

- [ ] You've reviewed your plan's sending, domain, and contact allowances in [Usage limits](/docs/api/usage-limits).
- [ ] Your code distinguishes rate limits (retry after `Retry-After`) from plan limits (no retry).

---

Source: https://connect.nxiom.com/docs/learn/production-checklist