---
title: Domains and DNS | SendHQ Docs
description: Provision sender identities and interpret DNS, SES, propagation, and repair states.
canonical: https://sendhq.cc/docs/domains
last-updated: 2026-09-07
---
# Domains and DNS

Provision sender identities and interpret DNS, SES, propagation, and repair states.

## Required records

SendHQ provisions three SES DKIM CNAMEs, an SPF TXT policy, a DMARC TXT policy, and the SES verification TXT value. Domain ownership is global within SendHQ because SES identity and reputation resources cannot safely be shared across workspaces.

## Verification states

**pending**

Resolvers successfully confirmed that at least one required value is absent.

**checking**

A resolver or provider result is unavailable, so absence has not been established.

**propagating**

Setup recently succeeded but public resolvers do not agree yet.

**verified**

SES accepts the sender identity and required DNS evidence is stable.

## Cloudflare one-time setup

The dashboard can request temporary `dns.read` and `dns.write` access. Setup is add-only and stops on conflicting SPF or DMARC policies. Repair mode applies only the DNS plan shown to the user. Tokens are not persisted.

## SPF and DMARC conflicts

Keep exactly one selectable SPF policy and one DMARC policy at their respective names. SendHQ reports a recommended merged SPF value or the DMARC value to retain; it does not silently overwrite an unrelated policy during ordinary setup.

## Refresh behavior

`POST /domains/:id/verify` performs an authoritative refresh. Domain reads return setup detail for the dashboard; applications should avoid polling faster than DNS can propagate.