Skip to content

Set up your sending domain

To send email with one of your company's addresses as the sender (for example news@example.com), the domain example.com must be active in DUO as a sending domain. DUO activates it only after confirming, through DNS, that the domain is yours.

You will need access to the domain's DNS management, or someone who can make the changes for you.

1. Add the domain

  1. Go to Settings → Domains and click New Domain.
  2. Type the domain name, without www or @: example.com.
  3. Under Share with sub-accounts, choose Yes if your organisation's sub-accounts will also send from this domain.
  4. Click Create.

2. Publish the DNS records

Open the domain from the list. It shows the warning This domain is not active yet. Click the Configure as sending domain tab: DUO shows the two records you need to publish.

Type Name Value
TXT example.com (usually @ in the DNS panel) DUO-DOMAIN-VERIFICATION=psk:…
TXT duo202012._domainkey.example.com (in the panel: duo202012._domainkey) v=DKIM1; k=rsa; s=email; p=…

Copy the values from the DUO screen, in full. The first one is different for each domain.

Tip

Most DNS panels append the domain to the name automatically. If you type the full name, the record ends up as duo202012._domainkey.example.com.example.com and DUO won't find it.

3. Activate the domain

  1. Wait a few minutes and refresh the domain page. DNS propagation can take up to an hour.
  2. When DUO finds both records, the tab shows an Enable as sending domain button. Click it.
  3. In the domain list, the Sending domain column now says Yes. Domain can be used in "from" address.

The domain is ready to use as the sender in campaigns, transactional messages and SMTP sending.

Activation only requires the two records above, but mail servers also check the domain's SPF and DMARC. Without them, more messages end up in spam.

  • SPF: add include:_spf.duo.pt to the domain's SPF record. A domain can only have one SPF record: if it already has one, add the include to it instead of creating another. Example, for a domain that also sends through Microsoft 365:

    v=spf1 include:_spf.duo.pt include:spf.protection.outlook.com ~all

  • DMARC: if the domain has none yet, start with a TXT record at _dmarc.example.com with the value v=DMARC1; p=none. Tighten the policy later, once you have confirmed that all legitimate mail passes.

Subdomains

To send from a subdomain, such as newsletter.example.com, add it as a domain of its own and publish the records DUO shows for it. The verification value is different from the main domain's. DUO accepts the records either on the subdomain or on the main domain (example.com).

Optional: bounce domain

By default, the links in your messages and the technical return address (envelope-from) use DUO domains. To keep duo.pt out of your messages entirely, also set up a bounce domain. It must be a subdomain, for example links.example.com:

  1. Add links.example.com in Settings → Domains.
  2. Publish a CNAME record links.example.com → go.duo.pt.
  3. Publish on example.com the DUO-DOMAIN-VERIFICATION=psk:… TXT record that DUO shows in the Configure as bounce domain tab (if you already published one for the sending domain, this value is different: publish both).
  4. Refresh the page and click Enable as bounce domain.

Common problems

The activation button doesn't appear. Check the record with a public tool, such as dig TXT duo202012._domainkey.example.com or an online DNS checker. The usual causes are a duplicated name (see the tip above), an incomplete value or extra spaces, and not waiting long enough for propagation.

Messages bounce with Domain example.com in header-from not authorized. The sender's domain is not in your DUO account. Add it and activate it as described above.

Messages go to spam. Check SPF and DMARC. If the problem persists, send us a message that went to spam, as an attachment, at ajuda@sooma.pt.

To do this through the API, see Domain.