Sending Domains

Every email you send from Mumara ONE, marketing or transactional, comes from a sending domain: the domain in your From address, such as example.com in news@example.com. You add it under Setup → Sending Domains, prove that you own it, and publish a few DNS records. Mailbox providers then see email that's signed by your domain, with links on your domain and bounces handled for your domain, which is what they need to trust it.

You don't run any mail servers. Mumara ONE generates the keys, signs your mail, processes your bounces and issues the SSL certificate for your tracking domain. Your part is publishing the DNS records the page shows you.

What you'll publish

A sending domain in Mumara ONE uses up to five DNS records. All of them go on subdomains of your domain, never on the root, so they don't interfere with your existing mailbox (MX) records, your website or other email services.

Record	Type	Host (for example.com)	What it does
Ownership verification	TXT	a 10-character code, e.g. 1a2b3c4d5e.example.com	Proves you control the domain. Needed once, before the other records are shown.
DKIM	TXT	selector._domainkey.example.com	Publishes the public key Mumara ONE uses to sign every message from this domain.
Tracking domain	CNAME	tracking-prefix.example.com	Puts click tracking, open tracking, the web version and the unsubscribe link on your own domain.
Bounce domain: SPF	TXT	bounce-prefix.example.com	Authorises Mumara ONE to send with your bounce subdomain as the return path, so SPF aligns with your domain.
Bounce domain: MX	MX, priority 10	bounce-prefix.example.com	Routes bounces for your domain back to Mumara ONE, where they're processed automatically.
DMARC (optional)	TXT	_dmarc.example.com	Tells mailbox providers what to do with mail that fails authentication, and where to send reports.

selector, tracking-prefix and bounce-prefix stand for the prefixes shown on your domain's page, and the values (the DKIM key, the CNAME target, the SPF include and the MX host) are specific to your account. Always copy hosts and values from the page rather than from this guide.

DKIM, tracking and bounce are required

On Mumara ONE plans, DKIM signing, the tracking domain and the bounce domain are required on every sending domain. That's why their on/off switches don't appear on the page: they're always on. DMARC is optional and has its own Enable DMARC switch. If your plan doesn't require one of the three, its card shows a switch in the header instead.

The Sending Domains page

Go to Setup → Sending Domains to see all your domains.

Column	What it shows
Sending Domain	The domain. Click it to open the domain's page.
Tracking Prefix	The subdomain prefix used for your tracking domain.
Redirection Type	How tracking traffic reaches Mumara ONE: cname.
DKIM	The DKIM record's state: Off, Pending, Passed or Failed.
Tracking Domain	The tracking CNAME's state: Off, Pending, Passed or Failed.
Verified	Whether ownership has been verified: Pending, Passed or Failed.
Created on	When the domain was added.
Actions	The row menu (see below).

If your plan limits the number of sending domains, a Domains Limit button above the table shows how many you've used, for example 2 / 5.

The Actions menu on each row offers:

Action	What it does
View sending domain	Opens the domain's page with all its records.
Verify domain key	Checks the DKIM record in DNS now.
Verify tracking domain	Checks the tracking CNAME in DNS now.
Download public domain key	Downloads the DKIM public key, for example to hand to whoever manages your DNS.
Delete	Removes the domain. See Deleting a sending domain.

A domain that has been suspended shows Suspended instead of the actions menu. Contact Mumara support if you see this.

Add a sending domain

1. Go to Setup → Sending Domains and click Add New.
2. In Domain Name, enter the domain you send from, without www or http://, for example example.com or mail.example.com.
3. Leave Use Secure URL switched on. Your tracking links will then use HTTPS, and Mumara ONE issues the certificate for you.
4. Click Add.

The domain's page opens on the first step, ownership verification.

Root domain or subdomain?

Use the domain your recipients will see in the From address. Because every record lives on a subdomain, adding your main domain (example.com) is safe and is usually the best choice for recognition and trust. A subdomain such as news.example.com works too, if you want to keep your marketing mail's reputation apart from your company mail.

When a domain can't be added

Message or situation	Why
"You have reached your maximum sending domains limit of …"	Your plan's sending-domain limit is used up. Delete a domain you no longer use or change your plan.
"Domain example.com is already linked."	The domain is already registered in another Mumara ONE account. Contact support if it's yours.
The domain is refused as reserved	Hostnames that Mumara ONE itself uses, such as one.mumara.com and Mumara's own tracking and mail hostnames, and subdomains of them, can't be added as sending domains.
Your account isn't active	Sending domains can't be added while your account is suspended or otherwise inactive.

Step 1: Verify domain ownership

Before the authentication records are shown, you prove that you control the domain. The page shows a Domain Ownership Verification card and a Pending Verification badge next to the domain name.

Choose one of the two methods:

• Add a DNS Record (the default). Add the TXT record shown: its host is a 10-character code in front of your domain, and its value is a verification code. The Current Value column shows what DNS returns for that host right now.
• Upload a File. Click Download File and upload the file to the root folder of your website, so it opens at http://example.com/ followed by the file's name. Check that the link opens in a browser.

Then click Verify Domain. When the check succeeds you'll see "Domain has been verified.", the badge changes to Verified, and the page shows the authentication cards described in the next step.

Step 2: Publish the authentication records

The top card, Sending Domain Authentication, shows the domain name, its status, the Domain Status switch and the Recheck button. Below it are one card per record type.

Copy only the bold part of the host

In every Host column, the part you type into your DNS provider is in bold, and your registered domain (for example .example.com) is in grey, because your DNS provider adds it for you. Click the host to copy the bold part. Use the copy button next to each value to copy the value.

Each row also has a Current Value column showing what DNS returns for that host right now, so you can see whether your change has propagated.

DKIM Authentication

Mumara ONE generates a DKIM key pair for the domain when you add it, keeps the private key and signs every message you send from the domain with it. You publish the public key:

Host	Type	Value
selector._domainkey (shown on the page)	TXT	Starts with v=DKIM1; k=rsa; p= followed by the public key.

The key is long. Some DNS providers accept it in one field; others need it split into several quoted strings. Either way works, as long as the whole key is published.

Sign Outgoing Emails is the switch that turns DKIM signing on or off for the domain. On Mumara ONE plans DKIM is required, so the switch is hidden and signing is always on.

If a Regenerate Keys link appears under the record, it creates a new key pair. After regenerating, replace the TXT record in DNS with the new value straight away: messages are signed with the new key, and the old record no longer matches.

Custom Tracking Domain

The tracking domain replaces Mumara ONE's shared tracking hostname in your emails with a subdomain of your own, for click tracking, open tracking, the web version link and the unsubscribe link. Links on your own domain look more trustworthy to recipients and to spam filters.

Host	Type	Value
tracking-prefix (shown on the page)	CNAME	The Mumara ONE tracking hostname shown on the page.

Mumara ONE's tracking uses the CNAME redirection type. If the card offers other redirection types, choose CNAME: the automatic SSL certificate is only available for CNAME tracking domains.

A CNAME host can't have other records

If the tracking host already has an A, AAAA or TXT record, most DNS providers won't let you add the CNAME. Remove the old record first, or use a different domain. If your DNS is on Cloudflare, set the record to DNS only (grey cloud) rather than proxied.

Use Secure URL and the SSL certificate

With Use Secure URL on, your tracking links use HTTPS. Mumara ONE issues a free SSL certificate for your tracking domain automatically as soon as its CNAME verifies. You don't need to buy or upload anything.

The tracking card shows the certificate's state next to the switch: SSL Valid, with who issued it, when it's valid from and when it expires, or No SSL Detected.

While a certificate is on its way, a banner at the top of the page tells you where things stand:

Banner	What it means
SSL pending DNS confirmation	Your tracking CNAME isn't verified yet. The certificate is issued automatically once it is; there's nothing to click.
Installing SSL certificate	The certificate is being issued. This usually takes a minute or two. You can keep working; the banner updates itself and confirms when the certificate is live.
Install SSL with Install SSL (Automatic)	The CNAME is verified but no certificate answers yet. Click the button, then Auto Install SSL in the dialog that opens. A padlock icon next to the Use Secure URL switch opens the same dialog.
Install SSL with Retry SSL Install	The last attempt didn't complete. Retry it. If it fails again, the dialog offers Contact support.

When the certificate is in place you'll see "SSL certificate installed — your tracking links are now served over HTTPS."

Until the certificate is installed

With Use Secure URL on and no certificate on the tracking domain, tracking links won't open. This is only a concern if you send before the certificate is issued. Wait for the banner to confirm, or check the SSL Valid badge, before you send.

Custom Bounce Domain

The bounce domain is a subdomain that becomes the return path (the envelope sender) of your email. Bounces for your domain come back to Mumara ONE through it and are processed automatically: no mailbox, no bounce rules. It also means SPF is checked against your own domain, which helps your messages pass DMARC.

Publish both records on the bounce host shown on the page:

Host	Type	Value
bounce-prefix (shown on the page)	TXT	The SPF record shown, which starts with v=spf1 and includes Mumara ONE's SPF domain.
bounce-prefix (shown on the page)	MX, priority 10	The Mumara ONE return-path host shown on the page.

Both records must pass. Until they do, your email uses Mumara ONE's default return path.

You don't need to change your root domain's SPF record

The SPF record for Mumara ONE goes on the bounce subdomain, not on example.com itself. Leave your root domain's SPF record as it is for your other mail services.

DMARC Authentication

DMARC builds on SPF and DKIM. It tells mailbox providers what to do with mail that claims to be from your domain but fails authentication, and where to send reports. Gmail and Yahoo expect a DMARC record from anyone sending bulk email.

DMARC is optional in Mumara ONE. Switch on Enable DMARC to show the record:

Host	Type	Value
_dmarc	TXT	The record shown on the page, for example v=DMARC1; p=none;

• Any valid DMARC record passes. If your domain already has one, keep it: there can only be one DMARC record per host, so extend the existing record rather than adding a second.
• Subdomains inherit. If your sending domain is a subdomain such as news.example.com, a DMARC record on example.com also covers it and satisfies the check. The card shows a note when this applies, and the Current Value column says which host the record was inherited from.
• Start with p=none. That's monitoring only. Tighten to quarantine or reject once you've confirmed that all the mail sent as your domain, from Mumara ONE and elsewhere, passes SPF or DKIM.

Step 3: Confirm and recheck

After you've published the records:

1. Click Confirm at the bottom of the domain's page. Mumara ONE checks every record, and each row shows a status icon:
   • a green check: the record is verified
   • a red cross: the record was found but doesn't match, or wasn't found
   • an hourglass: not checked yet, or still pending
2. Fix any record marked with a cross, then click Recheck at the top of the page. After each check, Recheck is unavailable for a short time, and the page shows "Button is disabled until" with a countdown.

If you've only just changed a record, give DNS time to propagate before rechecking. You'll see "If you have recently updated the DNS records, it may take a few hours for the changes to fully propagate."

You can also check one record from the list page, using Verify domain key or Verify tracking domain in the row's Actions menu.

Domain status

The domain's page shows its overall status next to the domain name.

Status	What it means	What to do
Pending Verification	Ownership hasn't been verified yet.	Complete step 1.
Pending Authentication	Ownership is verified, but not all required records have passed yet.	Publish the records, then click Confirm or Recheck.
Authentication Failed	One or more records failed their last check.	Compare the value with Current Value, fix the record, then click Recheck.
Active	Every required record is verified. You can send from this domain.	Nothing.
Inactive	You switched the domain off with the Domain Status switch.	Switch it back on to use it again.
Suspended	The domain has been suspended on our side. You can't change or use it.	Contact Mumara support.

Send only from Active domains. Until a domain is Active, it isn't offered when you choose the sending domain for your lists and campaigns.

Each record also has its own state (Off, Pending, Passed or Failed), shown in the list page's DKIM and Tracking Domain columns and as icons on the domain's page.

Ongoing checks

Mumara ONE re-checks the records of your verified domains every day, because DNS records can be changed or removed after the fact.

• If a record fails, you get an email warning you to check it. Nothing changes yet, and the domain keeps working.
• If the same record fails again at the next day's check, that part of the domain is switched off (for example, DKIM signing stops) and you get another email. Fix the record, open the domain's page and click Recheck.

A temporary DNS outage on our side is never counted as a failure.

One-click unsubscribe

Gmail, Yahoo and other providers expect bulk email to support one-click unsubscribe (RFC 8058). Mumara ONE supports it when Add List-Unsubscribe header is switched on for a campaign: every message then carries a List-Unsubscribe header with an unsubscribe link, plus a List-Unsubscribe-Post: List-Unsubscribe=One-Click header, so the mailbox provider can show its own Unsubscribe button and unsubscribe the contact without them visiting a page.

That link is served from your sending domain's tracking domain. For it to work well:

• make sure the Custom Tracking Domain record is verified, so the link is on your own domain, and
• keep Use Secure URL on with a valid certificate, because one-click unsubscribe links must use HTTPS.

Deleting a sending domain

1. On Setup → Sending Domains, open the row's Actions menu and click Delete.
2. Confirm the prompt.
3. If the domain is still used, for example by contact lists, you'll see "Unassign the domain (example.com) from the associated assets before deleting it." Choose another sending domain to move those assets to, and the domain is deleted once they've moved.

Deleting a domain also removes its tracking domain and certificate from Mumara ONE. Afterwards you can delete its DNS records.

Managing sending domains through the API

Everything on this page can also be done with the V2 REST API, which is useful if you onboard domains from your own application. The endpoints live under https://one.mumara.com/api/v2/sending-domains and follow the same two steps: add the domain and verify ownership, then publish and verify the remaining records. A verification call reports each record separately: what's expected, what DNS returns today, and whether it passed.

Each domain in an API response carries a status code and a next_step that tells your code what to do:

Status code	Shown in the app as	Next step
pending_ownership_verification	Pending Verification	verify_ownership
pending_authentication	Pending Authentication	verify_dns_records
authentication_failed	Authentication Failed	fix_dns_records
active	Active	none
inactive	Inactive	enable_domain
suspended	Suspended	contact_administrator: contact Mumara support
ownership_verification_revoked	(reported by the API only)	contact_administrator: contact Mumara support

The API applies the same rules as the app. For example, adding a reserved hostname fails with the code RESERVED_HOSTNAME, and adding a domain while your account isn't active fails with ACCOUNT_NOT_ACTIVE. The domain's private DKIM key is never returned by the API.

Your API key needs the V2 Sending Domains permissions. See API Keys for how to create one, and the API reference for every request and response.

Troubleshooting

A record won't verify

• Wait for propagation. Most changes show up within an hour, but some DNS providers take longer, and occasionally up to 48 hours. The Current Value column shows what DNS returns now. If it's still empty or old, it's too early to recheck.
• Check the host. The most common mistake is entering the full host where your DNS provider expects only the bold part, which produces a host like selector._domainkey.example.com.example.com. Click the host on the page to copy the right part.
• Check the whole value. For DKIM, make sure the entire key was saved and not cut off. Extra spaces or line breaks inside the key don't matter; missing characters do.
• One record per host. Don't publish two SPF records on the bounce host, or two DMARC records on _dmarc. Merge them into one.
• MX goes on the bounce host. The MX record belongs on the bounce subdomain shown on the page, never on your root domain, and it must point exactly at the host shown.

Current Value shows "No value found" or "Failed to load"

"No value found" means DNS returned nothing for that host yet: the record is missing or hasn't propagated. "Failed to load" means the lookup itself didn't finish; reload the page. If a check shows "The DNS lookup could not be completed, so nothing was changed.", the problem was reaching DNS resolvers, not your record. Try again in a few minutes.

The tracking domain fails

• Make sure the host has only the CNAME record and nothing else.
• If you use Cloudflare or another proxy or CDN, set the tracking record to DNS only. If you see a warning saying the CNAME resolved but the tracking domain may not work, requests to it aren't reaching Mumara ONE, which usually means a proxy is in front of it.

The SSL certificate isn't issued

• The certificate can only be issued after the tracking CNAME verifies. While it isn't, the banner reads SSL pending DNS confirmation.
• If your domain has CAA records, they must allow Let's Encrypt (letsencrypt.org), which issues Mumara ONE's tracking certificates.
• Use Retry SSL Install in the banner. If it still fails, contact Mumara support.

The domain was verified but now shows Authentication Failed

A record was changed or removed after verification, or failed the daily check twice. Compare each value with Current Value, fix the record and click Recheck.

Next steps

• Dedicated IPs: order IP addresses reserved for your account
• Dedicated Pools: decide which traffic uses which IPs
• Bridges: send transactional email from your application through your verified domain
• API Keys: manage sending domains from your own code