# Verify a domain. Sign every message.

Add a sending domain, drop the generated DNS records into your provider, and Bird signs every message with DKIM, SPF, and DMARC. Most verifications resolve within minutes, and Bird keeps re-checking the records afterward.

## Authentication, without digging through DNS records.

Sending domains are where deliverability starts on the Bird Email API. Bird generates the records, signs at the edge, and tells you the moment a domain falls out of alignment. Authentication becomes a setup step, not an ongoing investigation.

## Five steps to a signed domain.

We generate every record. You publish them once, and we keep them verified.

## One command, every record you need.

Add a domain from the dashboard, the API, or the CLI. Bird returns the exact records to publish: a DKIM key to sign your mail, a return-path CNAME that aligns SPF without touching your apex record, a DMARC record, and an optional tracking CNAME for branded open and click links. Then it verifies them for you.

## Branded open and click tracking.

Add the optional tracking CNAME and Bird measures opens and clicks under your own domain instead of a generic redirect. Opens come from a pixel in the HTML; clicks come from links rewritten through your branded hostname, so both the redirect and the link reputation stay with your brand, served over HTTPS.

Tracking is its own capability, separate from sending. A domain sends the moment DKIM, the return-path, and DMARC verify, with or without the tracking record in place. Open and click tracking switch on once the CNAME verifies and you turn them on.

It's opt-in for a reason. Rewritten links change the URL a recipient sees on hover and add a redirect hop, so leave click tracking off for password resets and security mail, where a clean direct link matters more than the metric.

## Verified once, watched forever.

Right after you add a domain Bird checks every couple of minutes, backs off to hourly over the first three days, then settles into a daily re-check of every active domain. If a verified record starts failing, the domain is held verified in a warning state, re-checked hourly, and your workspace is notified; it is only downgraded after a full 24 hours of failures, and any passing check inside that window clears the warning. A transient DNS blip cannot knock you offline, and a fixed record re-verifies on the next check without you asking.

## Go deeper in the docs.

Add and verify a domain with the sending domains guide, and read how the records work in the DKIM, SPF & DMARC guide.

## About 40% of the world's commercial email already runs on Bird.

Transactional and marketing email on infrastructure we've run for a decade. Domain authentication is one capability of the Bird Email API: sending, deliverability, dedicated IPs, suppression, and analytics ship with it.