Domains

Verify a domain for DKIM-aligned sending. DKIM alignment is how mailbox providers confirm the mail actually came from the claimed domain — and it is required for serious deliverability.

POST /v1/domains

Create the SES identity for a domain and return three DKIM CNAME records you must publish in the domain's DNS.

{"domain": "mail.example.com"}

Response — 201 Created

{
  "id": "…",
  "domain": "mail.example.com",
  "verification_status": "pending",
  "dkim_records": {
    "provider": "ses",
    "dkim_status": "PENDING",
    "cnames": [
      {"name": "abc123._domainkey.mail.example.com", "value": "abc123.dkim.amazonses.com"},
      {"name": "def456._domainkey.mail.example.com", "value": "def456.dkim.amazonses.com"},
      {"name": "ghi789._domainkey.mail.example.com", "value": "ghi789.dkim.amazonses.com"}
    ]
  },
  "created_at": "2026-04-20T16:00:00Z"
}

Publish all three CNAMEs at your DNS provider. Leave them unproxied (grey cloud if you use Cloudflare) — a proxy will rewrite the target and break DKIM.

POST /v1/domains/{id}/verify

Re-check SES for DKIM propagation. DNS can take up to a few hours; Finn also polls in the background, so you usually don't need to call this manually.

Response is the same Domain shape. When verification_status flips to "verified", the tenant is automatically promoted to the verified trust tier and a dedicated SES Tenant is provisioned.

GET /v1/domains

List all sending domains for this tenant with their current status.