Domains - Kourio

No message leaves a domain that has not been verified. This is not bureaucracy: without the records, the destination has no way to tell you apart from someone writing your name on the envelope.

The three records

	What it answers	If missing
SPF	Can this server send for this domain?	Forwarding and filters start rejecting
DKIM	Did this message come from who it says, unaltered?	Gmail and Yahoo reject bulk senders
DMARC	And if it fails, what should the destination do?	Without instruction, each server decides alone

DKIM is what survives forwarding. When someone forwards your email, the intermediate server becomes the sender and SPF breaks — the DKIM signature travels along and stays valid.

Use a subdomain

news.yourcompany.com, not yourcompany.com. If your newsletter and your password reset leave from the same domain, one bad campaign takes down the email someone is waiting for on screen. Separating them is what lets you make a mistake in one without paying for it in the other.

If the domain already has SPF — common with Google Workspace or Microsoft 365 — do not publish a second one. Two v=spf1 records on the same name are a permerror, and the domain ends up with no SPF at all: the mail you already send today starts failing. Add include:_spf.kourio.app to the record that exists.

Verification

The check runs on its own periodically. POST /v1/domains/{id}/verify exists so you do not have to wait for it after publishing. DNS takes minutes to hours to propagate — if it fails right after you publish, wait before changing anything.