Updates settings and configuration on a sending domain. `settings` changes apply immediately. Changes to `return_path`, `tracking`, or `dkim` on a verified capability are staged: the current configuration keeps serving until the new one's DNS records verify, then the change is promoted automatically. Staged values are visible under `capabilities.*.pending`; the records to publish appear in `dns_records` with `state: pending`. Domain ID. Per-domain behavior toggles. Changes apply immediately to new sends. Rewrite links in HTML email through your tracking domain to record clicks. You can enable this before your tracking domain has verified — it begins working once verification completes. A tracking domain must be configured; enabling it without one returns `409`. Insert a tracking pixel in HTML email to record opens. You can enable this before your tracking domain has verified — it begins working once verification completes. A tracking domain must be configured; enabling it without one returns `409`. Name part to use for the return-path domain. For example, `send` on `mail.acme.com` becomes `send.mail.acme.com`. Defaults to `send` when omitted at creation. Set or change the tracking name part, or remove tracking by passing null. Removal requires `click_tracking` and `open_tracking` to be disabled first, and returns `409` otherwise. After removal, links in previously sent email keep resolving while the tracking records are reported as `deprecated`. Name part to use for branded open and click tracking URLs. For example, `links` on `mail.acme.com` becomes `links.mail.acme.com`. How the DKIM public key is published in your DNS. - `txt` — you publish the DKIM public key as a TXT record. Key rotation requires updating the record. - `delegated` — preview, currently unavailable; supplying it returns `422`. When available, you publish a single CNAME and Bird hosts and rotates the key with no further DNS changes on your side. Set `true` to enable receiving on this domain, `false` to disable it. Disabling tears receiving down and removes the MX records from `dns_records`; this is immediate in the normal case, and if a step needs retrying the capability clears as soon as teardown finishes. The sending domain name. Set at creation and immutable. The DNS provider hosting this domain's nameservers, so you know which provider's dashboard to manage the required DNS records in. Returns "other" when the provider has not been detected or is not recognized. Domain ownership verification, proven by the DKIM record. Readiness to send or track is reported separately per capability under `capabilities.*.status`. - `pending` — the DKIM record has not been published yet. - `verified` — the DKIM record is in place; ownership is confirmed. - `failed` — a DKIM record exists but does not match the expected value (for example a stale record from an earlier setup), or a previously verified record was removed. Correct the record to recover. - `temporary_failure` — DNS resolution failed transiently (timeout, unreachable nameserver). Verification is queued for retry on a 72h cadence; customer should not edit DNS records before the retry runs. - `rejected` — the domain was refused for policy reasons and cannot be used for sending. Contact support if you believe this is an error. Per-domain behavior toggles. Changes apply immediately to new sends. Rewrite links in HTML email through your tracking domain to record clicks. You can enable this before your tracking domain has verified — it begins working once verification completes. A tracking domain must be configured; enabling it without one returns `409`. Insert a tracking pixel in HTML email to record opens. You can enable this before your tracking domain has verified — it begins working once verification completes. A tracking domain must be configured; enabling it without one returns `409`. Active DKIM signing configuration for the domain. How the DKIM public key is published in your DNS. `txt` — you publish the key as a TXT record. `delegated` — you publish a single CNAME and Bird hosts and rotates the key. DKIM selector used to sign mail from this domain. RSA key size in bits. Capability verification status. - `pending` — verification has not run, or is currently running. - `verified` — all DNS records for this capability resolved with the expected values. - `warning` — a record for this capability verified before and a recent check no longer matches, but it is still within the grace period. Sending is not yet affected; fix it before the grace period ends. - `failed` — DNS records resolved but at least one value is wrong. Update your DNS to recover. - `temporary_failure` — DNS lookup failed transiently. Verification is queued for retry; don't change DNS records yet. - `not_configured` — the capability is not set up on this domain (e.g. no tracking domain configured). Hostname this capability is configured with — the return-path domain, the tracking domain, or the domain where the DMARC policy was found. Null when not applicable or not configured. A staged configuration change awaiting DNS verification. The currently active configuration keeps serving until the staged one verifies, at which point it is promoted automatically. Submitting another change for the same capability replaces the staged value. Hostname the capability will use once the staged change verifies. Verification status of the staged change. `pending` — waiting for the DNS records to be detected. `failed` — the records resolved with wrong values; correct them or submit a different change. `temporary_failure` — DNS lookup failed transiently and will be retried. Machine-readable reason code for a failed capability status. Only set when `status` is `failed`. Use this to display a specific message to users rather than a generic failure message. - `tracking_domain_in_use` — the link tracking subdomain is already claimed by another organization. Capability verification status. - `pending` — verification has not run, or is currently running. - `verified` — all DNS records for this capability resolved with the expected values. - `warning` — a record for this capability verified before and a recent check no longer matches, but it is still within the grace period. Sending is not yet affected; fix it before the grace period ends. - `failed` — DNS records resolved but at least one value is wrong. Update your DNS to recover. - `temporary_failure` — DNS lookup failed transiently. Verification is queued for retry; don't change DNS records yet. - `not_configured` — the capability is not set up on this domain (e.g. no tracking domain configured). Hostname this capability is configured with — the return-path domain, the tracking domain, or the domain where the DMARC policy was found. Null when not applicable or not configured. A staged configuration change awaiting DNS verification. The currently active configuration keeps serving until the staged one verifies, at which point it is promoted automatically. Submitting another change for the same capability replaces the staged value. Hostname the capability will use once the staged change verifies. Verification status of the staged change. `pending` — waiting for the DNS records to be detected. `failed` — the records resolved with wrong values; correct them or submit a different change. `temporary_failure` — DNS lookup failed transiently and will be retried. Machine-readable reason code for a failed capability status. Only set when `status` is `failed`. Use this to display a specific message to users rather than a generic failure message. - `tracking_domain_in_use` — the link tracking subdomain is already claimed by another organization. Capability verification status. - `pending` — verification has not run, or is currently running. - `verified` — all DNS records for this capability resolved with the expected values. - `warning` — a record for this capability verified before and a recent check no longer matches, but it is still within the grace period. Sending is not yet affected; fix it before the grace period ends. - `failed` — DNS records resolved but at least one value is wrong. Update your DNS to recover. - `temporary_failure` — DNS lookup failed transiently. Verification is queued for retry; don't change DNS records yet. - `not_configured` — the capability is not set up on this domain (e.g. no tracking domain configured). Hostname this capability is configured with — the return-path domain, the tracking domain, or the domain where the DMARC policy was found. Null when not applicable or not configured. A staged configuration change awaiting DNS verification. The currently active configuration keeps serving until the staged one verifies, at which point it is promoted automatically. Submitting another change for the same capability replaces the staged value. Hostname the capability will use once the staged change verifies. Verification status of the staged change. `pending` — waiting for the DNS records to be detected. `failed` — the records resolved with wrong values; correct them or submit a different change. `temporary_failure` — DNS lookup failed transiently and will be retried. Machine-readable reason code for a failed capability status. Only set when `status` is `failed`. Use this to display a specific message to users rather than a generic failure message. - `tracking_domain_in_use` — the link tracking subdomain is already claimed by another organization. Capability verification status. - `pending` — verification has not run, or is currently running. - `verified` — all DNS records for this capability resolved with the expected values. - `warning` — a record for this capability verified before and a recent check no longer matches, but it is still within the grace period. Sending is not yet affected; fix it before the grace period ends. - `failed` — DNS records resolved but at least one value is wrong. Update your DNS to recover. - `temporary_failure` — DNS lookup failed transiently. Verification is queued for retry; don't change DNS records yet. - `not_configured` — the capability is not set up on this domain (e.g. no tracking domain configured). Hostname this capability is configured with — the return-path domain, the tracking domain, or the domain where the DMARC policy was found. Null when not applicable or not configured. A staged configuration change awaiting DNS verification. The currently active configuration keeps serving until the staged one verifies, at which point it is promoted automatically. Submitting another change for the same capability replaces the staged value. Hostname the capability will use once the staged change verifies. Verification status of the staged change. `pending` — waiting for the DNS records to be detected. `failed` — the records resolved with wrong values; correct them or submit a different change. `temporary_failure` — DNS lookup failed transiently and will be retried. Machine-readable reason code for a failed capability status. Only set when `status` is `failed`. Use this to display a specific message to users rather than a generic failure message. - `tracking_domain_in_use` — the link tracking subdomain is already claimed by another organization. Capability verification status. - `pending` — verification has not run, or is currently running. - `verified` — all DNS records for this capability resolved with the expected values. - `warning` — a record for this capability verified before and a recent check no longer matches, but it is still within the grace period. Sending is not yet affected; fix it before the grace period ends. - `failed` — DNS records resolved but at least one value is wrong. Update your DNS to recover. - `temporary_failure` — DNS lookup failed transiently. Verification is queued for retry; don't change DNS records yet. - `not_configured` — the capability is not set up on this domain (e.g. no tracking domain configured). Hostname this capability is configured with — the return-path domain, the tracking domain, or the domain where the DMARC policy was found. Null when not applicable or not configured. A staged configuration change awaiting DNS verification. The currently active configuration keeps serving until the staged one verifies, at which point it is promoted automatically. Submitting another change for the same capability replaces the staged value. Hostname the capability will use once the staged change verifies. Verification status of the staged change. `pending` — waiting for the DNS records to be detected. `failed` — the records resolved with wrong values; correct them or submit a different change. `temporary_failure` — DNS lookup failed transiently and will be retried. Machine-readable reason code for a failed capability status. Only set when `status` is `failed`. Use this to display a specific message to users rather than a generic failure message. - `tracking_domain_in_use` — the link tracking subdomain is already claimed by another organization. The domain's DNS records and their individual verification state, returned in full on both the list and single-domain responses. This is the complete set to publish across DKIM, return-path, DMARC, tracking, and inbound; records for a staged change carry `state: pending`. Inbound MX records are always included as a regional reference, even while receiving is off (`capabilities.inbound.status` is `not_configured`) — their presence alone does not mean receiving is enabled (see `DomainUpdate.inbound`). The record name — the part you enter in your DNS provider's "Name" or "Host" field, relative to the DNS zone the record belongs in (your registered domain). For a sending domain `mail.acme.com` the DKIM record name is `bird1._domainkey.mail`, entered in the `acme.com` zone. `@` for records at the zone apex. The fully qualified hostname for this record (e.g. `bird1._domainkey.mail.acme.com`). What this record is for. - `dkim` — signs outbound mail and proves domain ownership. - `return_path` — return-path (bounce) CNAME for sending. - `tracking` — branded open/click tracking CNAME (optional). - `dmarc` — advisory DMARC policy record. - `inbound_mx` — MX record routing mail to Bird for receiving. Always present wherever inbound is available, as a regional reference, regardless of whether receiving is enabled; publishing it does not enable receiving on its own — see `DomainUpdate.inbound`. Lifecycle state of this record. - `active` — the record backs the domain's current configuration. - `pending` — the record belongs to a staged configuration change; publish it to complete the change. - `deprecated` — the record belonged to a previous configuration. Keep it in DNS until `safe_to_remove` is `true`; in-flight mail and previously sent tracked links may still resolve through it. Whether this record can be skipped. Optional records enable extra functionality (e.g. tracking) but are not required for sending. Verification status of this record's most recent DNS check. - `pending` — the record has not verified yet; publish it (or correct it) and it will verify on the next check. - `verified` — the most recent check matched the expected value. - `warning` — the record verified before and a recent check no longer matched, but it is still within the grace period. Sending is not yet affected; fix the record before the grace period ends to avoid it being blocked. - `failed` — the record verified before but later checks kept failing past the grace period; the configuration has regressed and needs attention. Human-readable detail for a failed check on this record — what was found in DNS and why it did not match. Null when the record is verified or not yet checked. Only set on `deprecated` records: `true` once the record is no longer referenced by in-flight mail or live tracked links and can be deleted from your DNS. Null on `active` and `pending` records. When Bird last checked this domain's DNS records, whether or not the outcome changed. Updated on every verification — your manual refresh and the periodic automatic re-checks alike. Null if the domain has never been checked. When the domain's ownership was confirmed — the moment `status` became `verified` via the DKIM record. Unchanged by later re-checks while it stays verified. Null if the domain has never been verified. When the domain was added. When the domain's configuration was last changed (such as a settings or return-path change). Verification re-checks do not change this; see `last_checked_at` and `verified_at` for verification timing.