Verify an email sender domain

POST /v1/email-sender-domains/{sender_domain_id}:verify · permission email-sender-domains:write · all plans

Checks the domain's DNS records now and returns the updated domain. The platform also checks every domain daily with the same rules:

When the two DKIM CNAMEs and the return-path CNAME all point to the right targets, a pending_dns or degraded domain becomes verified.
When a verified domain keeps failing for 72 hours it becomes degraded, and the environment's email is sent from the platform domain until the records are fixed.
DMARC is reported in dmarc_alignment but is not required. When no _dmarc record exists, records includes a suggested one.

A domain disabled by the platform cannot be checked. Each environment can run 20 checks per hour.

Request

Field	Type	Required	Description
`sender_domain_id`	string	yes	Sender domain ID (`sdom_…`).
`Idempotency-Key`	header	no	Replays the same response for a repeated request with the same key.

No request body.

Response

200 OK with the checked sender domain and ETag set to its new version. The fields are described in Get an email sender domain.

{
  "id": "sdom_01k7r9m3q5t8v2w4x6y8z0a2b4",
  "domain": "mail.example.com",
  "status": "verified",
  "active_selector": "akp1",
  "dkim_status": "ok",
  "return_path_status": "ok",
  "dmarc_alignment": "no_record",
  "last_checked_at": "2026-10-19T09:30:00Z",
  "failing_since": null,
  "degraded_since": null,
  "records": [
    {
      "type": "CNAME",
      "name": "akp1._domainkey.mail.example.com",
      "value": "akp1.sdom_01k7r9m3q5t8v2w4x6y8z0a2b4.dkim.eu.keenauth.app",
      "required": true
    },
    {
      "type": "CNAME",
      "name": "akp2._domainkey.mail.example.com",
      "value": "akp2.sdom_01k7r9m3q5t8v2w4x6y8z0a2b4.dkim.eu.keenauth.app",
      "required": true
    },
    {
      "type": "CNAME",
      "name": "rp.mail.example.com",
      "value": "rp.eu.mail.keenauth.app",
      "required": true
    },
    {
      "type": "TXT",
      "name": "_dmarc.mail.example.com",
      "value": "v=DMARC1; p=none",
      "required": false
    }
  ],
  "version": 2,
  "created_at": "2026-10-19T09:00:00Z",
  "updated_at": "2026-10-19T09:30:00Z"
}

Errors

HTTP	code	When
404	`not_found`	The sender domain does not exist, belongs to another environment or the ID is malformed.
409	`conflict`	The domain is disabled by the platform.
429	`rate_limited`	The environment ran 20 checks in the last hour, or the general rate limit was exceeded; retry after the `Retry-After` period.
401	`unauthenticated`	The credential is missing, invalid or revoked.
403	`insufficient_permissions`	The credential lacks the required permission.
503	`service_unavailable`	A dependency is temporarily unavailable; retry after the `Retry-After` period.

Example

curl -X POST https://api.eu.keenauth.com/v1/email-sender-domains/sdom_01k7r9m3q5t8v2w4x6y8z0a2b4:verify \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"

CLI: keenauth email-sender-domains verify sdom_01k7r9m3q5t8v2w4x6y8z0a2b4