> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hiveku.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Domains

> Add and verify sending domains

Before you can send email through Hiveku, you must add and verify the domain you want to send from. Domain verification proves you own the domain and unlocks DKIM signing, which is required for good deliverability at Gmail, Outlook, Yahoo, and every other major mailbox provider.

<Warning>
  Never send from an unverified domain. Even if it worked, messages would fail DMARC and land in spam. Hiveku blocks sends from unverified domains.
</Warning>

## Why you need a verified domain

* **Authentication** — DKIM signing proves the message came from you
* **Reputation** — Your domain's reputation is tracked separately from the shared pool
* **Branding** — Recipients see `noreply@yourdomain.com`, not a generic Hiveku address
* **Compliance** — DMARC enforcement requires aligned DKIM or SPF

## Add a domain

<Steps>
  <Step title="Open the dashboard">
    Go to **Settings > Email > Domains** and click **Add Domain**.
  </Step>

  <Step title="Enter the domain">
    Enter the domain (or subdomain) you want to send from. We strongly recommend using a dedicated subdomain like `mail.acme.com` instead of the apex domain `acme.com` — it isolates sending reputation from your main domain.
  </Step>

  <Step title="Copy the DNS records">
    Hiveku generates DKIM, SPF, and DMARC records specific to your domain. Leave the page open while you add them to your DNS provider.
  </Step>
</Steps>

## DNS records to add

### DKIM (required)

DKIM signs your emails so receivers can verify authenticity. Hiveku provides **3 CNAME records**, one per AWS SES DKIM token.

| Type  | Name                              | Value                       |
| ----- | --------------------------------- | --------------------------- |
| CNAME | `abc123._domainkey.mail.acme.com` | `abc123.dkim.amazonses.com` |
| CNAME | `def456._domainkey.mail.acme.com` | `def456.dkim.amazonses.com` |
| CNAME | `ghi789._domainkey.mail.acme.com` | `ghi789.dkim.amazonses.com` |

### SPF (required)

SPF tells receivers which servers are allowed to send on behalf of your domain.

| Type | Name            | Value                               |
| ---- | --------------- | ----------------------------------- |
| TXT  | `mail.acme.com` | `v=spf1 include:amazonses.com ~all` |

<Info>
  If you already have an SPF record on this host, merge the `include:amazonses.com` term into your existing record instead of adding a second TXT record. Only one SPF record per host is allowed.
</Info>

### DMARC (strongly recommended)

DMARC tells receivers what to do with unauthenticated mail and where to send aggregate reports.

| Type | Name                   | Value                                               |
| ---- | ---------------------- | --------------------------------------------------- |
| TXT  | `_dmarc.mail.acme.com` | `v=DMARC1; p=quarantine; rua=mailto:dmarc@acme.com` |

Start with `p=quarantine` and graduate to `p=reject` once you have reviewed aggregate reports for a few weeks.

## Verify

Once you have added the DNS records, click **Verify** in the dashboard. Hiveku will query your DNS for the expected records and mark the domain as verified.

<Info>
  DNS propagation typically takes **15 minutes to 48 hours**. If verification fails, wait and retry — it almost always resolves within a day. You can also re-run the check from the domain detail page.
</Info>

## Domain reputation

Each verified domain has a reputation dashboard tracking:

* **Bounce rate** — Percentage of messages that hard-bounced (target: \< 5%)
* **Complaint rate** — Percentage of recipients who marked your mail as spam (target: \< 0.1%)
* **Reputation score** — A composite 0-100 score derived from bounces, complaints, and delivery patterns

If reputation drops below healthy thresholds, Hiveku will surface warnings in the dashboard and may pause sending on severely degraded domains.

## Default domain

When you have multiple verified domains, one is marked as the default. If a send request omits a `from` domain, Hiveku uses the default. Set the default from **Settings > Email > Domains**.

## Multiple domains

You can verify as many domains as you need. Common setups:

* `mail.acme.com` for marketing
* `tx.acme.com` for transactional
* `acme.dev` for internal or staging sends

Each domain is tracked and reputation-scored independently.