# Forwarding domains

This guide explains how site administrators review, add, and verify domains used for sending notifications and email-related communications.

The verification screen provides the exact DNS records required for the domain you entered. If your tenant shows values that differ from the legacy examples below, always use the values shown by the current product UI.

## Prerequisites

- you are signed in with site administrator permissions
- you can access the organization settings area
- you can make or request the required DNS changes for the domain


## Open domains

1. Open **Organization** from the settings icon in the top-right toolbar.
2. Select **Domains** in the left sidebar.


The **Domains** section lists sending domains configured for the organization. The list view includes an add-domain action, row actions, pagination, and columns for:

- status
- domain
- description
- update


![Domains section showing configured domains with status, domain, description, and update columns](/assets/admin-site-settings-domains.1a37cb754bb3b3411cc9feab4bd3cc5f1fe10f3be5d4b5f79451ff85a6460f78.6fd6141d.png)

## Add a domain

1. Open **Domains**.
2. Select the add-domain action.
3. Enter the required **Domain** and **Description**.
4. Select **Add**.
5. Complete the DNS configuration required to verify that the domain belongs to your organization.


The current UI reminds you that:

- you must have access to the domain or subdomain DNS settings
- the platform will verify domain ownership through DNS configuration
- using a subdomain is recommended so you can continue sending email from the root domain


![Add your domain screen showing the Domain and Description fields with guidance about DNS verification and the recommendation to use a subdomain](/assets/admin-site-settings-add-domain.527a33c0f6b05d82967675bfa7b4f88c8c2605bd95d5e004b31bda563a6a7a5f.6fd6141d.png)

## Verify the domain

After the domain is created, Namirial Notify opens the verification step and shows the DNS values that must be published for that domain.

1. Review the DNS records shown in the verification screen.
2. Copy the required SPF and DKIM values.
3. Publish the records in your DNS provider.
4. Wait for DNS propagation.
5. Return to the verification screen.
6. Select **Verify domain**.
7. Confirm that the verification indicators are updated.
8. Select **Save**.


The current verification screen exposes:

- a help panel that explains the DNS-verification process
- a summary of the selected `Domain` and `Description`
- a DNS table with columns such as `Type`, `Hostname`, `Enter this value`, and `Verified`
- an **Add custom DKIM key** action
- **Verify domain** and **Save** actions


In the current UI, the DNS table typically contains:

- one SPF record with type `TXT`
- two DKIM records with type `CNAME`


The exact hostnames and values are environment-specific. Always copy the values shown by the current product UI for the domain you are configuring.

## SPF configuration

The SPF record must authorize the sending infrastructure used by the platform.

Use the SPF row shown in the verification table for the exact `Hostname` and `Enter this value` pair required by your tenant.

Current environments typically expose one SPF row with:

- type `TXT`
- the selected sending domain or subdomain as the hostname
- an `include:` value that points to the platform SPF configuration for that environment


Legacy environments required an SPF record that included `_spf.evicertia.com`. A legacy example was:


```text
example.com TXT "v=spf1 mx include:_spf.evicertia.com ~all"
```

Your current tenant can show a different hostname or include value in the verification screen. Copy the exact value shown there when configuring DNS.

## DKIM configuration

The verification flow can expose one of two DKIM approaches:

### Shared selectors

Current environments typically expose two DKIM CNAME records in the verification table. The selector names can differ by environment, so copy the exact values shown by the UI.

Legacy environments commonly used two shared selectors provided by the platform. In that model, the DNS provider had to publish CNAME records following this pattern:

| Selector | Hostname pattern | Target pattern |
|  --- | --- | --- |
| `herma-a` | `herma-a._domainkey.<your-domain>` | `herma-a._domainkey.evicertia.com` |
| `herma-b` | `herma-b._domainkey.<your-domain>` | `herma-b._domainkey.evicertia.com` |


Example:


```text
herma-a._domainkey.acmedomain.com CNAME herma-a._domainkey.evicertia.com.
herma-b._domainkey.acmedomain.com CNAME herma-b._domainkey.evicertia.com.
```

### Custom selector

If the UI exposes **Add custom key**, you can create your own DKIM selector and publish a TXT record with the generated public key.

The resulting record usually follows this pattern:


```text
<selector>._domainkey.<your-domain> TXT "v=DKIM1; k=rsa; p=<generated-public-key>"
```

Use the exact selector name and public key generated by the verification flow.

## Relationship with profile email addresses

Users can register email addresses from **Profile > Emails**, but an email address is active for sending notifications only if the site administrator has configured the corresponding domain and the required DNS changes have been completed.

For profile-level email registration, see [User profile settings](/products/namirialnotify/admin/user-profile-settings).

## What to check

Before adding or changing a domain, confirm:

- you have permission to configure DNS for the domain or subdomain
- the domain belongs to the organization
- using a subdomain is acceptable for the sending use case
- registered user email addresses depend on the domain being configured and verified
- DNS changes have propagated before treating the domain as ready
- if you are using a custom DKIM selector, the published public key exactly matches the one generated by the platform
- after successful verification, you still save the domain configuration from the verification screen


## Expected result

The organization domain is listed in **Domains**, the verification indicators show success for the required SPF and DKIM records, and user email addresses under that domain can become active.

## Related

- [Admin overview](/products/namirialnotify/admin)
- [Site settings](/products/namirialnotify/admin/site-settings)
- [User profile settings](/products/namirialnotify/admin/user-profile-settings)