Email · sender vetting & domain registration
Before Bird delivers mail from your domain, the domain has to be registered in your workspace and verified — proof that you control it and that mailbox providers can authenticate your mail. This article explains what happens behind the scenes after you click "add domain", so you know what to expect and when. For the full setup walkthrough and API details, see the sending domains developer guide.
What happens when you add a domain
Adding a sending domain — in the dashboard or via the API — registers it against Bird's sending infrastructure and assigns your organization its own DKIM key. The domain starts in pending status, and Bird gives you the exact DNS records to publish:
- A DKIM TXT record — proves ownership and signs your mail.
- A return-path CNAME — routes bounces back to Bird and covers SPF.
- A DMARC policy — any valid v=DMARC1 record; a minimal p=none policy is enough.
- An optional tracking CNAME for branded open/click tracking (not required for sending).
There is no manual approval queue for standard domains: verification is entirely automatic, driven by your DNS. The only human-review path is the rare rejected status, applied when a domain is refused for policy reasons — if you see it, contact support.
How verification runs
You never have to poll or click a "check now" button. Bird starts checking your DNS records within seconds of registration, then re-checks on a backoff schedule over roughly the first 72 hours, after which the domain folds into a daily sweep that re-checks every active domain. The moment all the required records resolve correctly, the domain flips from pending to verified and sending unlocks once DKIM, the return-path CNAME, and DMARC are all in place.
If you have just fixed a DNS record and want an immediate re-check rather than waiting for the next scheduled one, the verify endpoint (and the equivalent dashboard button) triggers one on demand — rate-limited to 5 calls per domain per hour.
How long it takes
For most domains, verification completes within minutes of the DNS records being published correctly — the long pole is your DNS provider's propagation, not Bird. Some registrars propagate in seconds (Cloudflare), others can take an hour or more.
If your domain is still pending after a few hours, the records are almost certainly not resolving as expected — a typo in the host, a duplicated domain suffix, or a proxied CNAME are the usual suspects. Work through Why isn't my domain verifying? to diagnose it.
Verified is not forever
Verification is continuous, not a one-time gate. The daily sweep keeps checking verified domains, so if your DNS later breaks — a record deleted during a provider migration, a zone change that drops the DKIM TXT — Bird notices and the domain can flip back to unverified, stopping sends until the records are restored.
To avoid flapping on transient DNS blips, a verified domain is only downgraded after two consecutive failed re-checks, and any successful check resets the counter. Once you fix the records, the domain re-verifies automatically — no need to re-register or contact support.
The practical advice: treat your sending-domain DNS records as production infrastructure. If you migrate DNS providers or restructure your zone, carry the DKIM, return-path, and DMARC records over first.
Related pages
- Sending domains — the full developer guide: registration API, DNS record details, and the verification lifecycle.
- Why isn't my domain verifying? — diagnosing pending domains and DNS propagation.