Domains: two CNAME records to start sending

Before you can send from an address such as [email protected], api.email has to verify that you control acme.com. Verification also sets up the records that mailbox providers use to trust your mail. You add exactly two CNAME records; there is nothing to edit in your existing SPF record.

Add a domain

curl https://api.email/v1/domains \
  -H "Authorization: Bearer $API_EMAIL_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "acme.com"}'

{
  "id": "dom_4k2m9",
  "name": "acme.com",
  "status": "pending",
  "records": [
    { "type": "CNAME", "name": "send.acme.com", "value": "acme-com.rp.api.email" },
    { "type": "CNAME", "name": "api._domainkey.acme.com", "value": "acme-com.dkim.api.email" }
  ]
}

What the two records do

send.acme.com is the sending subdomain, used as the bounce address of your messages. It points to api.email, where the mail-exchange and SPF records live, so bounces come back to us and SPF passes for your domain.
api._domainkey.acme.com publishes the public key that verifies the DKIM signature on every message, so receivers can confirm the email was signed for acme.com.

Because both are CNAMEs, api.email can rotate keys and update infrastructure without asking you to change DNS again. If send is already used on your domain, for example by another email provider during a migration, pass a different prefix when you add the domain: {"name": "acme.com", "return_path": "mail"}.

Cloudflare: use DNS only

Cloudflare proxies CNAME records by default (the orange cloud). A proxied record hides the target, so verification fails. Set both records to DNS only (grey cloud).

Verification states

pending means the records are not visible yet. verified means you can send. failed means a record is missing or points to the wrong value; the dashboard shows which one. DNS changes usually propagate within minutes but can take longer with high TTLs.

DMARC

DMARC is a TXT record on your own domain that tells receivers what to do with mail that fails authentication. api.email doesn’t need it to send, but Gmail and Yahoo require it from bulk senders. If you have none, start with _dmarc.acme.com TXT "v=DMARC1; p=none" and tighten the policy once reports look clean.

Receiving on the same domain

To receive email, add an MX record that points the receiving domain, usually a subdomain such as in.acme.com, at mx.api.email. Sending and receiving can use the same domain or different ones.