Verify your sending domain
Publish SPF, DKIM, and DMARC records so your replies arrive in the inbox instead of the spam folder.
On this page
Until you do this, replies go out from a Kognit address. After it, they come from yours — and pass the authentication checks that decide whether mail reaches the inbox.
Add your domain
- Open Settings → Sender emails.
- Enter the address you want to send from (
help@yourcompany.com). - Choose Configure domain.
Kognit registers the domain and returns the DNS records to publish.
A domain can be connected to one workspace only. If you see "already connected to another workspace", someone else has claimed it — contact support rather than trying a variation of the address.
Publish the DNS records
At your DNS provider (Cloudflare, Route 53, GoDaddy, your registrar), add every record marked required.
| Record | Type | Purpose |
|---|---|---|
_amazonses.yourcompany.com | TXT | Proves you own the domain |
<token>._domainkey.yourcompany.com | CNAME | DKIM signing — three of these |
yourcompany.com | TXT | SPF — authorises sending |
_dmarc.yourcompany.com | TXT | DMARC policy |
The three DKIM CNAMEs are all required. Two out of three is the most common cause of a domain that never finishes verifying.
If you already have an SPF record
You must have exactly one SPF record per domain. Do not add a second — merge instead:
v=spf1 include:_spf.google.com include:amazonses.com ~allTwo SPF records is worse than none; receiving servers treat it as a permanent error.
Wait for verification
Choose Verify once the records are published. DNS propagation usually takes minutes but can take up to 48 hours.
You do not have to sit and re-click. Kognit re-checks pending domains automatically in the background and promotes them the moment DNS resolves, so a domain published overnight is verified by morning.
When is it usable?
A domain is only marked verified when both ownership and DKIM pass. Ownership alone is not enough: mail from an owned but unsigned domain fails DMARC at the recipient, which is exactly the outcome you are trying to avoid. Reporting that as verified would be a lie you would discover only when replies stopped arriving.
Verifying a single address instead
If you cannot change DNS, verify one address instead: Kognit emails a six-digit code, and Amazon SES sends its own confirmation link to the same mailbox. Click both and that one address becomes usable.
This is fine for a small team but weaker than domain authentication — you cannot send from any other address, and deliverability is not as strong.
See Sender addresses.
Related