Back to Blog
One record to verify: faster sending-domain setup

One record to verify: faster sending-domain setup

By Zend Team · September 12, 2026 · 5 min read

Before you can send email from your own domain, you have to prove you own it — and that means publishing DNS records. The fewer of those there are, the sooner you're sending and the less there is to get wrong. We just cut the biggest chunk of that setup down to a single record. Here's what changed, and why it's every bit as secure.

The old way: three records for one signature

The most important record in domain setup is DKIM. It's the cryptographic signature that lets a receiving mail server confirm a message really came from you and wasn't altered in transit. It's also what mailbox providers lean on hardest when they decide inbox versus spam.

Until now, turning DKIM on meant adding three DNS records — three CNAMEs that pointed back at our sending infrastructure:

abc123._domainkey.yourdomain.com   CNAME   abc123.dkim.tryzend.com
def456._domainkey.yourdomain.com   CNAME   def456.dkim.tryzend.com
ghi789._domainkey.yourdomain.com   CNAME   ghi789.dkim.tryzend.com

Why three? Because the signing keys were generated and rotated for you behind the scenes, and each key slot needs its own record. It works — but it's three lines to copy, three chances to mistype a value, and three records that all have to resolve before your domain will verify.

What changed: we generate the key, you publish one record

Now Zend generates the DKIM key pair itself and safeguards the private half. You publish a single record — the public key — as one TXT entry:

zdkim1a2b3c._domainkey.yourdomain.com   TXT   "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."

That's the whole DKIM step. One record instead of three.

This is exactly how public-key cryptography is meant to work. The public key is supposed to be published — that's how receiving servers verify our signature — while the private signing key never leaves our systems, where it's held encrypted at rest. Nothing sensitive ever touches your DNS.

What a domain needs now

A new sending domain verifies on three records, plus one we recommend:

  • DKIM — the single public-key TXT above. Signs every message you send.
  • MX and SPF on a return-path subdomain — these route bounces and authorize our infrastructure to send on your behalf.
  • DMARC (recommended) — a short policy record that ties SPF and DKIM together and gives you visibility into anyone sending as your domain.

Add them at your DNS provider, click Verify, and you're done. As before, any send from a domain that isn't fully verified is rejected, so you never leak half-authenticated mail.

Deliverability is exactly the same

To be clear about what did not change: your mail is still authenticated with both DKIM and SPF, still signed on every message, and still sent through reputation-monitored infrastructure. A one-record DKIM setup is every bit as strong as the three-record one — it's the same signature, published a simpler way. Inbox placement doesn't change; only the setup gets shorter.

Already verified? There's nothing to do

If you've already verified a domain, it keeps working exactly as it is — no new records, no re-verification, no action on your side. The simpler setup applies to any domain you add from here on.

Adding a domain takes a few minutes and a single DKIM record. See the Email documentation to get started, or add one straight from your dashboard.