LettermintLettermint
  • Knowledge base
  • Community
  • Changelog
  • Support
  • Documentation
  • Sending API
  • Team API
  • MCP server
Get started
Send email
Receive email
Manage
    Handle API tokens securely
    Projects and routes
    Domains
      Domain verificationDMARC policies for subdomainsReturn-Path and SPFDNS setup and sharingProject limits
    Webhooks
    Teams
Resources
Domains

Domain verification

Verify a domain you control before sending email from it. This tells inbox providers that Lettermint is allowed to send on your behalf and helps protect your domain from spoofing.

You need access to your domain's DNS settings. If someone else manages your DNS, you can share the setup instructions.

Choose a sending domain

We recommend using a subdomain such as mail.acme.com instead of your root domain acme.com. This separates your sending reputation from your website and regular business email.

Add and verify your domain

  1. Go to Domains and select Add domain
  2. Open the domain's DNS page and add all setup records to your DNS provider
  3. Return to Lettermint and select Verify all

Copy the record type, name, and value exactly as shown. DNS changes often appear within minutes, but can take up to 48 hours.

If DMARC shows Needs update, change aspf=s to aspf=r in the record named in the notice. Keep its other settings unchanged, then select Verify all. Lettermint blocks first verification until this SPF alignment mismatch is fixed. See SPF alignment with DMARC.

For previously verified domains, this mismatch shows a warning and does not stop sending. The notice stays visible until a DNS check finds the corrected record.

Authentication records

Your domain's DNS page shows the exact records you need.

DKIM

Confirms that messages were sent by Lettermint and were not changed in transit.

DMARC

Tells receiving servers how to handle authentication failures.

Return-Path

Handles bounces and provides SPF authentication for the Return-Path domain.

SPF is handled automatically via the Return-Path CNAME. You don't need to configure a separate SPF record.

Automatic DKIM rotation

Your DNS page may show two DKIM CNAME records, lm1._domainkey and lm2._domainkey (selectors lm1 and lm2). Add both and leave them in place. Lettermint uses the pair to rotate signing keys automatically, without asking you to change DNS again.

Updating an existing domain

If the DNS page offers a DKIM update, follow the guided steps. Add both new CNAME records and keep your current DKIM TXT record in place until the dashboard confirms that the update is complete. Sending continues while the update runs.

Troubleshooting

If a record remains pending:

  • Check that its type, name, and value match the dashboard exactly
  • Check whether your DNS provider automatically appended your domain name
  • In Cloudflare, set CNAME records to DNS only
  • Wait for DNS propagation, then select Verify all again

DNS provider guides

Cloudflare

Add DNS records in Cloudflare

TransIP

Add DNS records in TransIP

Domain Chief

Add DNS records in Domain Chief

AWS Route 53

Add DNS records in AWS Route 53

Next steps

DMARC subdomain policies

Understand exact and inherited DMARC policies.

Return-Path & SPF

Learn how the Return-Path record enables SPF alignment.

Domain Access Control

Restrict domain usage to specific projects.

Project accessDMARC policies for subdomains
On this page
  • Choose a sending domain
  • Add and verify your domain
  • Authentication records
    • Automatic DKIM rotation
  • Updating an existing domain
  • Troubleshooting
  • DNS provider guides
  • Next steps