Adding a domain is the third step of onboarding (after [creating your account](/getting-started/creating-your-account) and [connecting your AWS account](/aws-setup/connecting-aws)). Once a domain is verified, you can send email from any address on that domain.

## How domain verification works

When you add a domain in SendOps, the following happens behind the scenes:

1. SendOps calls AWS SES to initiate domain verification for your domain.
2. SES generates three CNAME records for DKIM signing.
3. SendOps displays these records in the dashboard, along with recommended SPF and DMARC records, so you can add them to your DNS provider.
4. You can check verification status at any time using the **Refresh** button on each domain row.



## Adding your domain


  <Step title="Open the Identities page">
    In the SendOps dashboard at [app.sendops.dev](https://app.sendops.dev), open **Infrastructure** in the sidebar and select the **Identities** tab. The page shows both Domain Identities and Email Identities in separate tables. In the Domain Identities section, click **Add Domain**.
  </Step>

  <Step title="Enter your domain name">
    Type the domain you want to verify (e.g., `mail.example.com`), then click **Add**. The region is determined by your organization's AWS connection.

    SendOps calls SES to initiate verification. After a moment, the dashboard displays the DNS records you need to configure.
  </Step>

  <Step title="Add DNS records at your DNS provider">
    Copy the DNS records from the SendOps dashboard and add them at your DNS provider (Route 53, Cloudflare, Namecheap, etc.). You will need to add the following records:

    | Type | Name | Value | Purpose |
    |------|------|-------|---------|
    | CNAME | `{token1}._domainkey.example.com` | `{token1}.dkim.amazonses.com` | DKIM signing (record 1 of 3) |
    | CNAME | `{token2}._domainkey.example.com` | `{token2}.dkim.amazonses.com` | DKIM signing (record 2 of 3) |
    | CNAME | `{token3}._domainkey.example.com` | `{token3}.dkim.amazonses.com` | DKIM signing (record 3 of 3) |

    The token values are unique to your domain and are generated by AWS SES. Use the copy buttons in the dashboard to avoid transcription errors.

    SendOps also displays recommended **SPF** and **DMARC** records for your domain. While not required for verification, these records improve deliverability and are strongly recommended.

    For detailed guidance on each record type, see [DNS Configuration](/domains/dns-configuration).
  </Step>

  <Step title="Verify your domain">
    Once the DNS records are in place, click the **Refresh** button on the domain row to check verification status. The domain status will change from **Pending** to **Verified** once SES confirms the records.
  </Step>



  DNS changes typically propagate within a few minutes, but in some cases can take **up to 72 hours** depending on your DNS provider and TTL settings. If your domain still shows as pending after a few hours, double-check that the records were entered exactly as shown in the dashboard.


## Importing existing domains from AWS SES

If you already have domains configured in your AWS SES account, SendOps can import them automatically. There are two ways this happens:

### Automatic sync

SendOps regularly syncs with your AWS SES account in the background. Any domains found in SES that aren't already in SendOps will appear on the Identities page with a **"New"** badge. You don't need to do anything — discovered domains show up automatically.

For more details on how sync works, see [AWS Account Sync](/aws-setup/account-sync).

### During onboarding

During the **Domain Verification** step of onboarding, you can click **Sync from AWS** to immediately scan your SES account. After syncing, SendOps shows:

- **Managed identities** — domains already connected to SendOps.
- **Unmanaged identities** — domains discovered from SES that are not yet connected.

For each unmanaged domain, click **Connect** to bring it under SendOps management. Connected domains will appear on the Identities page and can be assigned to channels, tracked for health, and used for sending.

You can also **Disconnect** a managed domain to stop managing it in SendOps without deleting it from SES.


  The **Delete** action permanently removes the domain from your AWS SES account, not just from SendOps. This cannot be undone. If you only want to hide a domain from your dashboard without affecting SES, use **Archive** instead. See [AWS Account Sync](/aws-setup/account-sync) for details on archiving.



  Sync discovers all identity types — both domains and individual email addresses. Any email identities found will also appear for you to connect or will be discovered automatically during background sync.


## Domain Identities table

The Domain Identities table on the Identities page displays the following columns for each domain:

| Column | Description |
|--------|-------------|
| **Domain** | Your sending domain name. May show a **"New"** badge if recently discovered from AWS, or a **"Detached"** / **"Archived"** badge. |
| **Status** | Current verification status (Pending, Verified, or Failed). |
| **DKIM** | Whether DKIM signing is configured and verified. |
| **SPF** | Whether SPF records are detected. |
| **DMARC** | Whether a DMARC policy is in place. |
| **Channel** | A dropdown to assign the domain to a [channel](/channels/understanding-channels). |
| **Health** | Health indicator derived from DKIM status: healthy (DKIM verified), critical (DKIM failed), or pending (in progress). |
| **Actions** | **Refresh** to check verification status with SES. **Archive** (for detached domains) to hide from the list. **Restore** (for archived domains) to bring back. **Delete** to permanently remove from SES. |

Archived domains are hidden by default. Enable the **Show archived** toggle above the table to see them.

For more on entity lifecycle states and what "Detached" and "Archived" mean, see [AWS Account Sync](/aws-setup/account-sync).

## What's next?

- Set up additional DNS records for SPF and DMARC in [DNS Configuration](/domains/dns-configuration).
- If you need to verify individual email addresses instead of a full domain, see [Email Identities](/domains/email-identities).
- Configure a [Tracking Domain](/domains/tracking-domains) for branded open and click tracking.