# Verify an email sender domain

`POST /v1/email-sender-domains/{sender_domain_id}:verify` · permission `email-sender-domains:write` · all plans

Checks the domain's DNS records now and returns the updated domain. The platform also checks every domain daily with the same rules:

- When the two DKIM CNAMEs and the return-path CNAME all point to the right targets, a `pending_dns` or `degraded` domain becomes `verified`.
- When a `verified` domain keeps failing for 72 hours it becomes `degraded`, and the environment's email is sent from the platform domain until the records are fixed.
- DMARC is reported in `dmarc_alignment` but is not required. When no `_dmarc` record exists, `records` includes a suggested one.

A domain disabled by the platform cannot be checked. Each environment can run 20 checks per hour.

## Request

| Field | Type | Required | Description |
|---|---|---|---|
| `sender_domain_id` | string | yes | Sender domain ID (`sdom_…`). |
| `Idempotency-Key` | header | no | Replays the same response for a repeated request with the same key. |

No request body.

## Response

`200 OK` with the checked sender domain and `ETag` set to its new version. The fields are described in [Get an email sender domain](get.md).

```json
{
  "id": "sdom_01k7r9m3q5t8v2w4x6y8z0a2b4",
  "domain": "mail.example.com",
  "status": "verified",
  "active_selector": "akp1",
  "dkim_status": "ok",
  "return_path_status": "ok",
  "dmarc_alignment": "no_record",
  "last_checked_at": "2026-10-19T09:30:00Z",
  "failing_since": null,
  "degraded_since": null,
  "records": [
    {
      "type": "CNAME",
      "name": "akp1._domainkey.mail.example.com",
      "value": "akp1.sdom_01k7r9m3q5t8v2w4x6y8z0a2b4.dkim.eu.keenauth.app",
      "required": true
    },
    {
      "type": "CNAME",
      "name": "akp2._domainkey.mail.example.com",
      "value": "akp2.sdom_01k7r9m3q5t8v2w4x6y8z0a2b4.dkim.eu.keenauth.app",
      "required": true
    },
    {
      "type": "CNAME",
      "name": "rp.mail.example.com",
      "value": "rp.eu.mail.keenauth.app",
      "required": true
    },
    {
      "type": "TXT",
      "name": "_dmarc.mail.example.com",
      "value": "v=DMARC1; p=none",
      "required": false
    }
  ],
  "version": 2,
  "created_at": "2026-10-19T09:00:00Z",
  "updated_at": "2026-10-19T09:30:00Z"
}
```

## Errors

| HTTP | code | When |
|---|---|---|
| 404 | `not_found` | The sender domain does not exist, belongs to another environment or the ID is malformed. |
| 409 | `conflict` | The domain is disabled by the platform. |
| 429 | `rate_limited` | The environment ran 20 checks in the last hour, or the general rate limit was exceeded; retry after the `Retry-After` period. |
| 401 | `unauthenticated` | The credential is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The credential lacks the required permission. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry after the `Retry-After` period. |

## Example

```bash
curl -X POST https://api.eu.keenauth.com/v1/email-sender-domains/sdom_01k7r9m3q5t8v2w4x6y8z0a2b4:verify \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```

CLI: `keenauth email-sender-domains verify sdom_01k7r9m3q5t8v2w4x6y8z0a2b4`