Domains & DKIM/SPF/DMARC
To send from your own domain, you verify it once by publishing a few DNS records. Orizon generates a DKIM keypair for you and checks the records over DNS-over-HTTPS.
Add a sending domain
In the dashboard's email section, add a domain (e.g. yourdomain.com). Orizon generates a 2048-bit DKIM keypair and returns the exact DNS records to publish. The private key is encrypted at rest and never leaves Orizon.
Publish the DNS records
Orizon gives you four records, parameterised for the active provider:
- DKIM — a TXT record at
<selector>._domainkey.yourdomain.comcarrying your public key (v=DKIM1; k=rsa; p=…). The default selector isorizon. - SPF — a TXT record on the mail-from subdomain authorising the provider to send (
v=spf1 include:… ~all). - MX — an MX record on the mail-from subdomain for bounce / feedback handling.
- DMARC — a TXT record at
_dmarc.yourdomain.com, starting at a safep=nonepolicy you can tighten later.
# Shapes (exact values are shown in the dashboard for your domain)
orizon._domainkey.yourdomain.com TXT v=DKIM1; k=rsa; p=<public-key>
send.yourdomain.com TXT v=spf1 include:<provider> ~all
send.yourdomain.com MX 10 <provider-feedback-host>
_dmarc.yourdomain.com TXT v=DMARC1; p=none; rua=mailto:[email protected]Verify
Once the records are live, hit Verify. Orizon queries DNS over HTTPS and confirms the DKIM key matches, SPF is present, and the MX record exists. When all checks pass the domain is marked verified and registered with the provider, and you can send from any address on it.
PropagationDNS changes can take anywhere from minutes to a few hours to propagate. If verification fails right after publishing, wait and try again — the records simply may not be visible yet.