# Domain Verification

Verify your domain with AWS SES for reliable email delivery. Wraps automates DKIM setup; you add DNS records.

## Why Verify?

- Proves ownership of your sending domain to AWS SES
- Enables DKIM signing (improves deliverability and prevents spoofing)
- Required before sending in production (SES sandbox mode blocks unverified senders)
- Needed for SPF and DMARC alignment

## The Three Pillars of Email Auth

- **DKIM**: Cryptographic signature proving the email was sent from your domain
- **SPF**: Lists authorized mail servers for your domain (automatic with Wraps — SES handles it)
- **DMARC**: Policy telling receivers what to do with failed DKIM/SPF checks

## Step 1: Add Your Domain

```bash
npx @wraps.dev/cli email domains add -d yourdomain.com
```

## Step 2: Get DKIM Records

```bash
npx @wraps.dev/cli email domains get-dkim -d yourdomain.com
```

You'll get 3 CNAME records like:

```
# Record 1
Name:  abc123._domainkey.yourdomain.com
Type:  CNAME
Value: abc123.dkim.amazonses.com

# Record 2
Name:  def456._domainkey.yourdomain.com
Type:  CNAME
Value: def456.dkim.amazonses.com

# Record 3
Name:  ghi789._domainkey.yourdomain.com
Type:  CNAME
Value: ghi789.dkim.amazonses.com
```

Add all 3 to your DNS provider (Vercel, Cloudflare, Route53, etc.).

> **Note**: On Cloudflare, set the CNAME record to "DNS only" (not proxied).

## Step 3: Verify DNS Records

```bash
npx @wraps.dev/cli email domains verify -d yourdomain.com
```

DNS propagation takes up to 72 hours, but usually completes within 30 minutes.

## Step 4: SPF (Automatic)

SPF is configured automatically by SES. You don't need to add an SPF record manually — SES uses its own SPF alignment via the `amazonses.com` sending domain.

## Step 5: Add DMARC (Recommended)

```bash
# Add this TXT record to your DNS
Name:  _dmarc.yourdomain.com
Type:  TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
```

DMARC policy options:
- `p=none` — Monitor only (recommended to start)
- `p=quarantine` — Failed emails go to spam
- `p=reject` — Failed emails are rejected

## Verification Checklist

- [ ] Domain added to SES (`domains add`)
- [ ] 3 DKIM CNAME records added to DNS
- [ ] DNS records verified (`domains verify` shows all green)
- [ ] DMARC TXT record added

## Troubleshooting

- **DKIM not verifying**: DNS propagation can take up to 72 hours. Run `domains verify` again later.
- **Wrong record format**: Some providers auto-append your domain. Use only the subdomain prefix (e.g., `abc123._domainkey`, not `abc123._domainkey.yourdomain.com`).
- **Still in sandbox**: Request production access from the AWS SES console.

## Next Steps

- [Production Access Guide](https://wraps.dev/docs/guides/production-access)
- [Email SDK Reference](https://wraps.dev/docs/sdk-reference)