Domains and DNS

Required records

SendHQ provisions three SES DKIM CNAMEs, an SPF TXT policy, a DMARC TXT policy, and the SES verification TXT value. Domain ownership is global within SendHQ because SES identity and reputation resources cannot safely be shared across workspaces.

Verification states

pending

Resolvers successfully confirmed that at least one required value is absent.

checking

A resolver or provider result is unavailable, so absence has not been established.

propagating

Setup recently succeeded but public resolvers do not agree yet.

verified

SES accepts the sender identity and required DNS evidence is stable.

Cloudflare one-time setup

The dashboard can request temporary dns.read and dns.write access. Setup is add-only and stops on conflicting SPF or DMARC policies. Repair mode applies only the DNS plan shown to the user. Tokens are not persisted.

SPF and DMARC conflicts

Keep exactly one selectable SPF policy and one DMARC policy at their respective names. SendHQ reports a recommended merged SPF value or the DMARC value to retain; it does not silently overwrite an unrelated policy during ordinary setup.

Refresh behavior

POST /domains/:id/verify performs an authoritative refresh. Domain reads return setup detail for the dashboard; applications should avoid polling faster than DNS can propagate.