> ## Documentation Index
> Fetch the complete documentation index at: https://docs.brudcast.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify your domain

> Ask Brudcast to check your DNS records, read what each result means, and fix the records that don't match.

export const Loop = ({id, src, alt, caption}) => {
  if (!src) {
    return <Placeholder id={id} kind="loop" label="Animation coming soon" description={alt} icon={<PlayIcon />} />;
  }
  return <figure className="brd-media" data-media-id={id}>
      <video className="brd-media-frame" src={src} autoPlay muted loop playsInline aria-label={alt} />
      {caption && <figcaption className="brd-media-caption">{caption}</figcaption>}
    </figure>;
};

export const Screenshot = ({id, src, srcDark, alt, caption}) => {
  if (!src) {
    return <Placeholder id={id} kind="screenshot" label="Screenshot coming soon" description={alt} icon={<ImageIcon />} />;
  }
  return <figure className="brd-media" data-media-id={id}>
      <img className="brd-media-frame block dark:hidden" src={src} alt={alt} />
      <img className="brd-media-frame hidden dark:block" src={srcDark || src} alt={alt} />
      {caption && <figcaption className="brd-media-caption">{caption}</figcaption>}
    </figure>;
};

Confirm your published DNS records so the domain can send.

<Screenshot id="ss-email-verify-hero-all-verified" alt="A sending domain marked Verified with DKIM, SPF, DMARC and Tracking all showing Verified" />

<Info>
  **Before you start:** publish the five records from the domain's **DNS Records** tab.
  [DNS records](/channels/email/dns-records) explains each one and how to publish it at the common
  DNS providers.
</Info>

## What verification checks

Brudcast looks up each record in public DNS and compares the answer with the expected value. Letter
case and a trailing dot are ignored.

* **The domain's status depends on one record:** the SPF delegation CNAME at `brd.spf.<your domain>`.
  When it matches, the domain becomes **Verified** and can send. When it doesn't, the domain shows
  **Failed**.
* **DKIM, DMARC and tracking are checked and shown separately.** They don't change the domain's
  status, but mail without published DKIM records fails DKIM at receiving servers. Get all four
  green.

## Run the check

<Steps>
  <Step title="Wait for DNS to update">
    <Snippet file="dns-propagation.mdx" />
  </Step>

  <Step title="Open the domain">
    Go to **Channels > Email**, open the **Domains** tab, and select the domain.
  </Step>

  <Step title="Select Verify DNS">
    **Verify DNS** is at the top right of the domain page. The check runs in the background, and the
    results appear on the page as they come in.

    <Loop id="lp-email-verify-run-check" alt="Selecting Verify DNS and watching the DKIM, SPF, DMARC and Tracking checks turn green" />
  </Step>

  <Step title="Read the results">
    The strip under the domain name shows **DKIM**, **SPF**, **DMARC** and **Tracking**, each marked
    **Verified** or **Not yet verified**. The **DNS Records** tab marks each record **Verified** or
    **Unconfigured**. If any of SPF, DKIM or DMARC is missing, a "Complete your domain setup" banner
    names them.
  </Step>
</Steps>

You can run the check as often as you like. There's no penalty for a failed check. The first time a
domain verifies or fails, the person who created the organization is emailed the result.

## What each failure means

Here's what a red result points at. The full answer for each one, with the ranked causes and the
provider traps behind them, is in
[Email troubleshooting](/channels/email/troubleshooting#verifying-dns-records).

<AccordionGroup>
  <Accordion title="SPF is not verified and the domain shows Failed">
    **Why:** the lookup of `brd.spf.<your domain>` didn't return the expected target, usually a
    doubled name, a record in the wrong zone, or a Cloudflare record left proxied.
    **Fix:** [The domain shows Failed after you run Verify DNS](/channels/email/troubleshooting#verifying-dns-records).
  </Accordion>

  <Accordion title="DKIM is not yet verified">
    **Why:** one or both of `brd1._domainkey` and `brd2._domainkey` is missing, proxied, or points
    somewhere else. The domain still verifies, but your mail fails DKIM.
    **Fix:** [DKIM stays “Not yet verified”](/channels/email/troubleshooting#verifying-dns-records).
  </Accordion>

  <Accordion title="DMARC is not yet verified">
    **Why:** the `_dmarc` TXT record is missing, or a different DMARC record is there, and Brudcast
    compares the whole value.
    **Fix:** [DMARC stays “Not yet verified”](/channels/email/troubleshooting#verifying-dns-records).
  </Accordion>

  <Accordion title="Tracking is not yet verified">
    **Why:** the tracking CNAME is missing, or you changed the tracking hostname and haven't
    published the new record yet.
    **Fix:** [Tracking stays “Not yet verified”](/channels/email/troubleshooting#verifying-dns-records).
  </Accordion>

  <Accordion title="dig shows the right value but the check still fails">
    **Why:** your machine or a resolver in between may still be holding a cached answer.
    **Fix:** [dig shows the right value but the check still fails](/channels/email/troubleshooting#verifying-dns-records).
  </Accordion>
</AccordionGroup>

## After verification

* **Send your first email.** The domain can send now, so put it to use. See
  [Send your first email](/channels/email/send-your-first-email).
* Save [sender addresses](/channels/email/add-a-sending-domain#sender-addresses) to make them quick
  to pick in campaigns.
* To send from code, create [SMTP users](/channels/email/smtp-users) or
  [sending keys](/channels/email/domain-api-keys).
* If you've been using the managed sending address, it now retires in 14 days. See
  [The managed sending address](/channels/email/overview#the-managed-sending-address).

## Keep the records published

Treat the Brudcast records as permanent parts of your zone. If you remove or change one, receiving
servers stop being able to authenticate your mail straight away. The dashboard only shows the change
the next time you run **Verify DNS**.

## Check DKIM from the API

The platform API can check the live DKIM record on its own, without rerunning every check:
`GET /api/v1/user/sending-domains/{id}/dkims/verify`, with the `domains:read` scope. It returns
`propagated` (the expected key is published) and `mismatch` (a different key is published). See the
[API reference](/api-reference/introduction).

## Related

<Columns cols={2}>
  <Card title="Send your first email" icon="send" href="/channels/email/send-your-first-email">
    Your domain can send. Use it from a campaign, the API or SMTP.
  </Card>

  <Card title="DNS records" icon="server" href="/channels/email/dns-records">
    What each record does.
  </Card>

  <Card title="DNS by provider" icon="server" href="/channels/email/dns-by-provider">
    Fix a record at Cloudflare, Route 53, Namecheap, GoDaddy and others.
  </Card>

  <Card title="Email troubleshooting" icon="life-buoy" href="/channels/email/troubleshooting">
    Verification failures and sending errors.
  </Card>
</Columns>