---
title: "Verify domain DNS or apply DNS via Cloudflare, Vercel, or GoDaddy"
method: POST
path: "/domains/{id}"
tags: ["Domains"]
---

# Verify domain DNS or apply DNS via Cloudflare, Vercel, or GoDaddy

`POST /domains/{id}`

## Request

- Base URL: `https://api.supersendtx.com`
- URL: `https://api.supersendtx.com/domains/{id}`
- Auth: HTTP bearer

`verify` checks public DNS, registers the domain on the mail server, and returns the
domain detail plus `verified`, `checks`, and signing status. `apply` writes the DNS
records at Cloudflare, GoDaddy, or Vercel and returns a per-record `results` list plus
the full `records` set it applied.

## Path parameters

- `id` string, required

## Request body

- object
  - `action` 'verify' | 'apply', required
  - `provider` 'cloudflare' | 'godaddy' | 'vercel': Required when action is apply
  - `credentials` RemoteApplyDnsCredentials
    - `apiToken` string: Inline Cloudflare API token instead of the stored dashboard integration
    - `zoneId` string: Optional Cloudflare zone id when using an inline token
    - `cloudflareApiToken` string: Alias for apiToken
    - `cloudflareZoneId` string: Alias for zoneId
    - `apiKey` string: GoDaddy API key
    - `apiSecret` string: GoDaddy API secret
    - `godaddyApiKey` string: Alias for apiKey
    - `godaddyApiSecret` string: Alias for apiSecret
    - `vercelApiToken` string: Alias for apiToken when provider is vercel
    - `vercelTeamId` string: Optional Vercel team id for team-scoped DNS
    - `teamId` string: Inline Vercel team id (alias for vercelTeamId)

## Response `200`

Domain verified, or DNS apply results

- union
  - VerifyDomainResponse
    - `domain` Domain, required
      - `id` string, required
      - `name` string, required
      - `status` 'pending' | 'verified' | 'failed', required
      - `created_at` string, date-time, required
      - `verified_at` string, date-time, nullable, required
      - `open_tracking` boolean, required: Open tracking preference for this domain.
      - `click_tracking` boolean, required: Click tracking preference for this domain.
      - `tls_mode` 'opportunistic' | 'enforced', required: Preferred outbound TLS behavior for this domain.
      - `inbound_enabled` boolean, required: True when SuperSend TX should accept inbound mail for this domain.
      - `inbound_status` 'disabled' | 'pending' | 'active' | 'error', required: `pending` before verification, `active` once inbound receiving is configured, or `error` when setup fails.
      - `inbound_error` string, nullable, required: Why inbound setup failed when `inbound_status` is `error`. Verify the domain again to retry.
    - `records` DnsRecord[], required
      - `type` 'TXT' | 'CNAME' | 'MX', required: DNS record type. The return path is always a single `CNAME`, set to DNS only (not proxied). Publish no other records on the return-path host.
      - `host` string, required
      - `value` string, required: Record content. For MX records, the mail server hostname (priority is in `priority`).
      - `priority` integer: MX preference when `type` is `MX` (lower is preferred).
      - `purpose` string, required: Human-readable purpose (`Domain ownership`, `DKIM`, `Return path`, `SPF`, `DMARC`, `Open/click tracking`, `Inbound receiving`)
    - `analysis` DomainDnsAnalysis
      - `dmarc` DomainDmarcAnalysis, required
        - `host` string, required
        - `configured` boolean, required
        - `record` string, nullable, required
        - `policy` string, nullable, required: Parsed DMARC `p=` policy when present (`none`, `quarantine`, or `reject`)
        - `rua` string[], required
        - `guidance` string, required
      - `bimi` DomainBimiAnalysis, required
        - `host` string, required
        - `configured` boolean, required
        - `record` string, nullable, required
        - `location` string, nullable, required: Parsed BIMI `l=` logo URL when present
        - `authority` string, nullable, required: Parsed BIMI `a=` VMC URL when present
        - `requires_dmarc_enforcement` boolean, required: True when BIMI is unlikely to work until DMARC is set to p=quarantine or p=reject
        - `guidance` string, required
    - `inbound_records` DnsRecord[], required
      - `type` 'TXT' | 'CNAME' | 'MX', required: DNS record type. The return path is always a single `CNAME`, set to DNS only (not proxied). Publish no other records on the return-path host.
      - `host` string, required
      - `value` string, required: Record content. For MX records, the mail server hostname (priority is in `priority`).
      - `priority` integer: MX preference when `type` is `MX` (lower is preferred).
      - `purpose` string, required: Human-readable purpose (`Domain ownership`, `DKIM`, `Return path`, `SPF`, `DMARC`, `Open/click tracking`, `Inbound receiving`)
    - `inbound_note` string, required
    - `tracking_dns` DomainTrackingDns
      - `required` boolean, required: True when open or click tracking is enabled for this domain.
      - `host` string, nullable, required: Customer CNAME host (e.g. ps.example.com) when tracking is required.
      - `target` string, nullable, required: Tracking CNAME target when tracking is required.
      - `ok` boolean, nullable, required: Whether tracking DNS is live; null when tracking is disabled.
    - `verified` boolean, required
    - `auto` boolean
    - `mail_server_registered` boolean: Whether the domain is registered on the mail server. Always true on a successful verify.
    - `checks` object: Public DNS checks. DMARC is reported but does not block verification.
      - `ownership` boolean
      - `spf` boolean
      - `dkim` boolean
      - `dmarc` boolean
      - `return_path` boolean
    - `inbound_configured` boolean
    - `inbound_pending` boolean
    - `inbound_error` string, nullable
    - `signing_ready` boolean: True when the mail server will DKIM-sign with this domain's key (not the shared pool fallback).
    - `mail_server_signing` MailServerSigningStatus: Mail-server delivery DNS statuses recorded when verify re-checks the domain.
      - `dkim_ok` boolean
      - `return_path_ok` boolean
      - `dkim_status` string, nullable
      - `return_path_status` string, nullable
  - ApplyDomainDnsResponse
    - `provider` 'cloudflare' | 'godaddy' | 'vercel', required
    - `domain` string, required
    - `results` ApplyDnsRecordResult[], required
      - `purpose` string, required
      - `host` string, required
      - `action` 'created' | 'updated' | 'unchanged' | 'merged', required
      - `detail` string
    - `records` DnsRecord[], required: The full record set that was applied — the sending records, plus the inbound MX record when inbound receiving is enabled.
      - `type` 'TXT' | 'CNAME' | 'MX', required: DNS record type. The return path is always a single `CNAME`, set to DNS only (not proxied). Publish no other records on the return-path host.
      - `host` string, required
      - `value` string, required: Record content. For MX records, the mail server hostname (priority is in `priority`).
      - `priority` integer: MX preference when `type` is `MX` (lower is preferred).
      - `purpose` string, required: Human-readable purpose (`Domain ownership`, `DKIM`, `Return path`, `SPF`, `DMARC`, `Open/click tracking`, `Inbound receiving`)

## Other responses

- `400`: DNS not fully ready yet (propagation — response includes pending:true, checks, and records), the mail server has not confirmed DKIM or return-path readiness yet (response includes mail_server_signing), missing provider credentials, or an invalid action or provider
- `401`: Missing or invalid API key / session
- `404`: Domain not found
- `502`: The mail server's DNS records for the domain are not ready yet, domain registration on the mail server failed, the mail server could not confirm signing readiness, or the DNS provider API returned an error during apply
- `503`: Credentials encryption key not configured

---

[API](https://skmtc.dev/ranla/apis/supersend-tx-api.md) · [All operations](https://skmtc.dev/ranla/apis/supersend-tx-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ranla/apis/supersend-tx-api/revisions/e3e782652f50?raw)