Customer-facing surfaces

Custom send domain.

Send dunning emails from your own subdomain (e.g., mail.yourcompany.com) instead of our shared sender. Better deliverability, real brand alignment, ~5 minutes plus DNS propagation. Under the hood we register the subdomain as an Amazon SES sending identity with EasyDKIM (AWS-managed 2048-bit key rotation) — you publish the DNS records the settings page generates and click verify.

Add a domain

  1. Go to Settings → Send domainin the workspace dashboard (the page is titled “Send from your domain”).
  2. In the Subdomain field, enter the subdomain you want to send from. Use a dedicated subdomain like mail. or notify. — not your apex (yourcompany.com). Sharing the apex with marketing tools hurts your transactional deliverability.
  3. Click Add domain. We register the SES identity with EasyDKIM, auto-config a tenant-aligned Return-Path (bounce.<yourdomain>), and the page switches to a status view that lists the DNS records to publish.

Add the DNS records

The status view shows a DNS records table (Type / Name / Value / Priority / TTL / Status). Copy the exact Name and Valuefrom that table into your DNS provider — don't hand-type from this doc, because the DKIM tokens are unique to your domain. There are three groups:

1. DKIM — three CNAME records (required to send)

SES's EasyDKIM issues three tokens; each becomes a CNAME. These are the gate: once they verify, your domain can send.

  • CNAME at <token>._domainkey.yourcompany.com → <token>.dkim.amazonses.com (TTL 1800). All three follow this pattern with different tokens.

2. MAIL FROM — one MX + one SPF TXT (SPF alignment)

Two records at bounce.yourcompany.com that move your envelope sender onto a subdomain you control, so SPF aligns to your domain instead of amazonses.com:

  • MX at bounce.yourcompany.com → feedback-smtp.<region>.amazonses.com, priority 10 (TTL 1800).
  • TXT at bounce.yourcompany.com → v=spf1 include:amazonses.com ~all (TTL 1800).

3. DMARC — one TXT record (advisory)

  • TXT at _dmarc.yourcompany.com → v=DMARC1; p=none;(TTL 1800). We can't verify this for you — it's advisory — but Gmail/Yahoo bulk-sender rules and strict receivers like ProtonMail increasingly down-rank or reject mail from domains with no DMARC at all. p=noneis monitor-only, so publishing it can't bounce your other mail. If you already have DMARC on your organizational domain, that counts — we check the parent domain too.

Verify

Once the records are published, click Verify now. SES has no on-demand re-check endpoint — AWS polls your DNS on its own cadence — so this reads the current identity status rather than triggering a fresh check. CNAME propagation is usually a few minutes but can take up to a day; if the status badge isn't green yet, give DNS time and click again. Refresh status does the same read without changing anything.

The status badge moves through pending → verified (or failed / temporary_failure if the records are wrong/missing). Once it reads verified, new dunning emails send from noreply@yourcompany.com with your From name.

What you can customize

The sending domain is separate from how the emails look. Brand the emails on these settings pages:

  • From name, accent color, logo, and website link — under Settings → Email branding (From name defaults to your workspace name; empty fields fall back to neutral defaults).
  • Subject A/B variants per dunning kind (up to 4, weighted at send time) with a z-test winner detector — under Settings → Email A/B testing.
  • Body overrides per dunning kind — replace the default copy while keeping our layout chrome — also under Settings → Email A/B testing.

Removing

From the same settings page, click Remove domain and confirm. We delete the SES sending identity and the sender reverts to the shared trybackstop.com default. The DNS records are yours to clean up at your provider.

Related