verify a domain

Mailway signs your email with DKIM keys we generate and manage for you. Your DNS only delegates — two CNAME records pointing into our zone. Key rotation and any future infrastructure changes happen on our side without you touching DNS again.

the records

mw1._domainkey.yourdomain.com  CNAME  mw1.yourdomain-com.dkim.<mailway zone>
mw2._domainkey.yourdomain.com  CNAME  mw2.yourdomain-com.dkim.<mailway zone>

The exact values are shown on your domain's page in the dashboard with copy buttons. The second selector is a hot spare that lets us rotate keys with zero downtime.

DMARC (recommended)

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=none;"

Not required to send, but Gmail and Yahoo treat mail from DMARC-covered domains better. Start with p=none (monitor only) — tighten later.

how verification works

We query your domain's own nameservers directly (not a caching resolver), so verification doesn't flap on stale TTLs. Status moves pending → verified; we re-check pending domains every 10 minutes for 7 days, and you can trigger a check anytime with the verify button or POST /domains/{id}/verify.

registrar notes

Cloudflare: add the CNAMEs with the proxy toggled off (grey cloud) — DKIM lookups must see the CNAME itself. Most other registrars work as-is; if your UI appends the domain automatically, enter only mw1._domainkey as the name.