Every domain you add is a new identity — a new colour in the margin and a new From you can be reached at. The wizard lives at /app/domains/new. It asks for the domain you'd like to bind, then presents the required records as copy-paste cards.

§ The records

Publish the records the wizard prints at your registrar (Cloudflare, Route 53, Namecheap, whoever holds the zone). Names are written as suffixes; most registrars accept the leading @ or will append your apex automatically. New domains usually show seven records: four public mail records, one Amazon SES identity TXT, and two MAIL FROM records under mail. for Return-Path alignment.

DNS · Example for the domain studio.example
TypeNameValue
MX · prio 10@inbound.wm.emcognito.com.
TXT@v=spf1 include:amazonses.com ~all
CNAMEem1._domainkeyem1._domainkey.wm.emcognito.com.
TXT_dmarcv=DMARC1; p=quarantine; rua=mailto:dmarc@emcognito.com
Aside

Because the DMARC rua address points at dmarc@emcognito.com, any external reporting authorization under _report._dmarc.emcognito.com is owned and published by Folio. It is not an extra record for your DNS checklist.

  • ·MX tells the world that letters for your domain should arrive at our inbound server.
  • ·SPF (that first TXT) declares which senders are allowed to write on your behalf.
  • ·DKIM (the CNAME) publishes the public half of a signing key; outgoing letters are signed with the private half.
  • ·DMARC (the _dmarc TXT) tells receivers what to do if a letter arrives unsigned — and sends aggregate reports to Folio for review.
  • ·SES identity (the _amazonses TXT) proves to Amazon SES that you control the domain.
  • ·MAIL FROM (the mail. MX and SPF pair) aligns the outbound Return-Path with your domain instead of a shared carrier domain.

§ Verification

Once the records are in place, open the domain detail page and click Verify now. If you want to watch it settle, Auto-poll 10 s repeats the check while DNS and SES catch up. You do not need to wait on the page forever — background verification also revisits pending domains. Most zones resolve in under ten minutes; Cloudflare, in our experience, is closer to two.

Aside

A domain can sit at pending for up to forty-eight hours without issue. Only at that point do we stop polling and ask you to check the records manually.

§ Sending enabled

Once the DNS, SES identity, and MAIL FROM gates are green, a final green badge appears on the domain: sending enabled. From that moment forward, any reply to a letter that arrived at *@studio.example will be sent from that domain, DKIM-signed in its own key.

If you only want to receive on a domain and never send, inbound routing can work before the outbound carrier gates finish. The UI keeps that distinction visible instead of pretending the domain is fully send-ready early.