Email from your own domain

Every email a service sends to its users, such as sign in codes, invitations and password resets, comes from no-reply@microauth.com with the service's name as the sender name. On plans that include a custom email domain, those emails can come from an address on your own domain instead, such as hello@acme.com. The pricing page shows which plans include it, for sign in services and APIs alike.

MicroAuth sends through Mailraft, our email service, which signs each email for your domain with DKIM so inboxes can trust it.

Add the domain

1. Open Branding and domain for a sign in service, or Portal for an API, then Email.

2. Enter the address to send from, such as hello and acme.com, and click Add domain. Leave the first part as it is and emails come from no-reply@ your domain. Only workspace owners and admins can add, change or remove the domain.

3. Add the records the dashboard shows where the domain's DNS is managed:

   Record	Type	What it does
   DKIM	TXT	Signs your emails. Nothing comes from your domain until it passes.
   Return path	CNAME	Bounces come back to Mailraft through it.
   DMARC	TXT	Tells inboxes what to do with email that fails the checks.
   SPF	TXT	Optional. Only needed if you check SPF for the domain itself.

4. Wait a few minutes. MicroAuth checks every 10 minutes for the first three days and hourly after that, or click Check now, up to 20 times an hour.

Once DKIM passes, emails switch to your address by themselves, and workspace owners and admins get an email saying so. Each record shows Found, Not found or Wrong value after every check, with the reason.

The dashboard shows names the way most DNS providers want them, without your domain on the end, such as mr1._domainkey for mr1._domainkey.acme.com. If your provider asks for the full name, add the domain to the end.

Cloudflare

Set the CNAME to DNS only, the grey cloud. With the orange cloud on, Cloudflare answers for the record itself and the return path doesn't work.

Long DKIM values

Some DNS providers only take TXT values of up to 255 characters. Click Copy it in parts under the value and add each part as its own string in the same record.

A domain more than one service uses

The same domain can send for several services, in your workspace or in someone else's, and each one proves it owns the domain:

• The first service to add a domain that has never been verified proves it by publishing the DKIM record.
• Every other service adds one more TXT record at _microauth. followed by the domain, such as _microauth.acme.com. The dashboard shows the value, which is different for each service. The same goes for a domain that was verified before, even by a service that has since stopped using it.
• If two services add a new domain before its DKIM record is published, nobody can tell which one published it, so both need the TXT record.

Until a service proves it owns the domain, its emails keep coming from no-reply@microauth.com, and the badge says Prove ownership. MicroAuth doesn't check the TXT record again once the service owns the domain.

Sending

• Emails come from your address with the service's name as the sender name. Replies go to the support email when the service has one, which an API sets under Portal, Links and code.
• Send a test email emails you from the new address, up to 5 times an hour.
• Change the part before the @ under Sender at any time.
• If the return path or DMARC record is missing, emails still go out, and the dashboard says what's missing. Inboxes trust your emails more with every record in place.

When something stops working

Emails never wait on your DNS. Whenever they can't come from your domain, they come from no-reply@microauth.com:

• The DKIM record goes missing. MicroAuth checks verified domains every 6 hours. When DKIM stops passing, emails move back to the MicroAuth address, owners and admins get an email, and the badge says Stopped working. Put the records back and emails switch back by themselves.
• Mailraft refuses an email from your domain. That email goes out from the MicroAuth address instead.
• Your plan stops including it. Emails come from the MicroAuth address right away, the badge says Paused, and owners and admins get an email within 10 minutes. The domain stays set up, so a plan that includes it again switches them back at once.

Removing the domain

Remove domain sends emails from no-reply@microauth.com again right away, and you can delete the DNS records afterwards. Deleting the service removes its email domain too. An hour after the last service stops using a domain, MicroAuth removes it from Mailraft.