> ## Documentation Index
> Fetch the complete documentation index at: https://docs.instantcampaign.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Sender identity and domain authentication

> Set who your email comes from, add the postal address the law requires, and authenticate your sending domain with SPF, DKIM and DMARC.

Mailbox providers decide where your email lands mostly by asking two questions: *who is this from?* and *can they prove it?* This page covers both.

* **Settings → Sender Information** sets the from name, from address, reply-to and the postal address printed in your footer.
* **Settings → Domain Authentication** publishes the DNS records (DKIM, SPF, DMARC) that prove the mail is really yours.

Only owners and administrators can change these.

## Sender Information

The page has two parts.

### Sender Profiles

A sender profile is a named identity: **Profile Label** (for example "Marketing" or "Support"), **From Name**, **From Email** and an optional **Reply-to Email**. One profile is the **Default**, and campaigns that don't pick a profile use it.

<Steps>
  <Step title="Open Sender Information">
    Go to **Settings → Sender Information** and click **Add Profile** (or **Create First Profile**).
  </Step>

  <Step title="Fill in the identity">
    Enter the label and from name. For **From Email**, type the inbox name (the part before `@`) and pick the domain from the list.
  </Step>

  <Step title="Save">
    Click **Create Profile**. Use **Set as default** on a profile to make it the default.
  </Step>
</Steps>

<Warning>
  The domain list only offers domains your workspace has **verified**, either under **Domain Authentication** or at one of your connected email providers. If the list is empty, you'll see "No verified sending domains yet". Verify a domain first (below), then come back.
</Warning>

If a connected provider can't be asked for its sender list (for example, an API key that's only allowed to send), the page says the list may be incomplete. Verify the domain under **Domain Authentication** instead.

Deleting a profile is permanent. Campaigns that used it fall back to the default profile.

### Company and postal address

Below the profiles, enter your **Company Name**, **Street Address**, **City**, **State / Region**, **Zip / Postal Code**, **Country** and **Phone**, then click **Save Sender Info**. Anti-spam laws (CAN-SPAM, GDPR) require a physical postal address in marketing email, and the compliance footer prints what you enter here.

<Note>
  A missing address doesn't block sending. The footer simply leaves it out. The [Getting started](/guides/sending-and-workspace/getting-started) checklist doesn't count the sender step as done until street, city and country are set.
</Note>

## Domain Authentication

<Steps>
  <Step title="Add the domain">
    Go to **Settings → Domain Authentication** and click **Add Domain**. Enter just the domain, such as `example.com`, without `https://` or a trailing slash.
  </Step>

  <Step title="Publish the DNS records">
    Expand the domain to see its records. Each has a copy button. Add them at your DNS provider (Cloudflare, Route 53, GoDaddy and so on) exactly as shown.
  </Step>

  <Step title="Verify">
    Click **Verify**. Each record shows **Found and matches** or **Not found or does not match**. When every record passes, the domain shows **Verified**.
  </Step>
</Steps>

DNS changes can take up to 72 hours to propagate. If verification fails right after you publish the records, wait and click **Verify** again.

### Which records you'll see

The records depend on how the workspace delivers mail when you add the domain.

**Platform sending (Amazon SES):**

| Record          | Type  | Name                                                            |
| --------------- | ----- | --------------------------------------------------------------- |
| DKIM Record 1–3 | CNAME | `<token>._domainkey.example.com` → `<token>.dkim.amazonses.com` |
| SPF Record      | TXT   | `example.com` → `v=spf1 include:amazonses.com ~all`             |
| DMARC Record    | TXT   | `_dmarc.example.com`                                            |
| MAIL FROM MX    | MX    | `mail.example.com` → `10 feedback-smtp.<region>.amazonses.com`  |
| MAIL FROM SPF   | TXT   | `mail.example.com` → `v=spf1 include:amazonses.com ~all`        |

In this mode, the page checks the domain's status automatically every 30 seconds while it's pending, and shows **SES Status**.

**Other sending:** a single **DKIM Record** (TXT, selector `ic1`), an **SPF Record** at the root of the domain, and a **DMARC Record**.

<Tip>
  **Already have an SPF record?** A domain can only have one SPF TXT record. Don't add a second one. Merge the `include:` entries shown here into your existing record.
</Tip>

### The DMARC record

The DMARC record we generate looks like this:

```
v=DMARC1; p=none; rua=mailto:ic-<token>@dmarc.instantcampaign.ai; adkim=r; aspf=r
```

* `p=none` is a safe starting point. It monitors and doesn't reject anything. Tighten it to `quarantine` or `reject` yourself once you've seen your alignment data.
* The `rua=` address is ours, and it's unique to this domain. Receivers send their daily aggregate reports there, and those reports fill in the **DMARC alignment** column on the Deliverability page. You don't need to change your MX records or mail hosting. See [DMARC reports](/guides/sending-and-workspace/dmarc-reports).

Paste the value exactly as shown. If you already publish a DMARC record, you can keep your own `rua` mailbox and add ours, separated by a comma.

### Sending through your own provider

If you send through a connected provider such as Postmark, Mailgun, SendGrid, Resend or your own SES account, that provider must also have verified your domain, **in its own dashboard**. Creating a sender profile here doesn't verify anything with your provider. See [Email sending providers](/guides/sending-and-workspace/email-providers).

## Troubleshooting

<AccordionGroup>
  <Accordion title="Verification keeps failing">
    Check that you added each record at the exact **Name** shown. Some DNS providers append your domain automatically, so `_dmarc.example.com` becomes `_dmarc.example.com.example.com`. If yours does, enter only the part before your domain. Then wait for propagation and click **Verify** again.
  </Accordion>

  <Accordion title="A domain that was verified is now flagged">
    The Deliverability page re-checks DNS and flags **DNS drift** when published records stop matching. Campaign sends from a drifted domain are blocked until it's fixed. See [Deliverability and warm-up](/guides/sending-and-workspace/deliverability).
  </Accordion>

  <Accordion title="My sender profile says the domain is no longer verified">
    A profile on a lapsed domain stays in the list but can't be saved again until the domain is verified.
  </Accordion>
</AccordionGroup>