Domain Verification

Verify a sending domain to improve deliverability and avoid spam folders. Most verifications complete in 5–30 minutes after DNS changes propagate.

Why verify your domain?

When you send email from hello@mail.yourdomain.com, receiving email servers check your DNS records to confirm that you actually own that domain and that Quolle is authorised to send on your behalf. Without these records, your emails are more likely to land in spam or be rejected entirely.

There are three standards that together protect your domain:

SPF (Sender Policy Framework) — a DNS TXT record that lists the servers allowed to send email for your domain. Quolle's sending infrastructure is added to this list.
DKIM (DomainKeys Identified Mail) — cryptographically signs your email with a private key. Receiving servers verify the signature using the public key in your DNS. This proves the message wasn't tampered with in transit.
DMARC (Domain-based Message Authentication) — tells receiving servers what to do if SPF or DKIM checks fail: none (monitor only), quarantine (send to spam), or reject (block entirely). Quolle starts you on p=none with aggregate reporting (rua) so you can monitor authentication before tightening the policy.

Step by step

Add your domain in the dashboard

Go to Domains → Add domain and enter your sending domain. Use a subdomain like mail.yourdomain.com rather than your apex domain — it keeps your email records separate from your website records.

Add the DNS records

You'll receive several records to publish. The exact values are shown in your dashboard — the first one is unique to your account, so copy it from there rather than from this page.

Type	Name	Value	Purpose
`TXT`	`_quolle-challenge.yourdomain.com`	`quolle-verify=<unique to your account>`	Ownership — proves the domain is yours
`TXT`	`_dmarc.yourdomain.com`	`v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com`	DMARC — authentication policy + reporting
`TXT`	`quolle._domainkey.yourdomain.com`	`v=DKIM1; k=rsa; p=<public key>`	DKIM — cryptographic signature
`MX`	`mail.yourdomain.com`	`feedback-smtp.us-east-1.amazonses.com` (priority 10)	MAIL FROM — white-label Return-Path
`TXT`	`mail.yourdomain.com`	`v=spf1 include:spf.quolle.com ~all`	SPF for the MAIL FROM subdomain

Nothing goes on your root domain. Every record above sits on a subdomain — mail., _dmarc., quolle._domainkey. or _quolle-challenge.. We deliberately don't ask you to edit the SPF record at your apex, because that record also governs your Google Workspace or Microsoft 365 mail, and a mistaken edit there breaks it. SPF for our mail is checked against the Return-Path, which is mail.yourdomain.com.

Two of these need a closer look

The ownership record (_quolle-challenge) contains a value generated for your account alone. Every other record above is predictable from your domain name, so this is the one that proves the domain is actually yours rather than someone else's you happen to know about. Copy it from your dashboard — it is different for every account, and a domain won't verify without it.

The DKIM record is about 410 characters, which is longer than the 255-character limit for a single TXT string. That is normal for a 2048-bit key: DNS stores it as several quoted strings inside one record and resolvers join them back together.

Cloudflare, Route 53 and most modern DNS providers handle the splitting for you — paste the value exactly as shown. Some older control panels accept the long value, silently cut it off at 255 characters, and leave you with a DKIM record that looks correct and fails every signature check. If your provider rejects the value or visibly shortens it, use the Copy pre-split version button next to the record in your dashboard, which formats it as "first-part" "second-part" for you.

Cloudflare users: one-click automatic setup

If your domain uses Cloudflare nameservers, a purple banner appears in the Add domain modal. Click Add via Cloudflare and authorise access — all DNS records are added automatically. No copy-pasting required.

After authorising, DNS changes are applied within seconds on Cloudflare. The domain typically verifies within a few minutes.

Wait for propagation

DNS changes typically propagate within 5–30 minutes, though it can take up to 48 hours in rare cases. Once your records are live, click Verify next to your domain in the dashboard.

Start sending

Once the status shows verified, you can send email from any address on that domain. Your from field must match the verified domain, e.g. hello@mail.yourdomain.com.

Common issues

My domain is stuck on pending

DNS propagation can take time. Use a tool like dnschecker.org to verify that your TXT and CNAME records are visible globally. Once they appear, click Verify again.

Make sure you added records for the exact hostnames shown in the dashboard — including any subdomain prefix like mail..

Do I need to change my existing SPF record?

No. Quolle doesn't touch the SPF record at your root domain, so your existing mail — Google Workspace, Microsoft 365, anything else — is unaffected. Our SPF lives on mail.yourdomain.com, which is where receivers check it for mail we send.

Domains added before this change may still have include:spf.quolle.com at the root. That's harmless and needs no action.

My DKIM record was accepted but the domain still won't verify

The most common cause is truncation. The DKIM value is longer than a single TXT string can hold, and some DNS panels quietly cut it at 255 characters instead of splitting it. The record then exists, looks plausible, and fails every check.

Compare what your provider stored against what the dashboard shows — if the saved value is shorter, that's the problem. Use Copy pre-split version next to the record and paste that instead.

My domain is verified on another account

A domain can only be verified on one Quolle account at a time. If you're told the domain is already verified elsewhere and you believe you own it — for example it was set up by a colleague, an agency, or on a previous account — email support@quolle.com and we'll transfer it after confirming ownership.

I get a 400 error when sending

Your from address must use a domain that is verified in your account. Check that the domain status is verified (not just pending). If you're sending from hello@mail.acme.com, the domain mail.acme.com must be verified — not just acme.com.

Emails going to spam

A few things to check:

All three DNS record types (SPF, DKIM, DMARC) are published and verified
Your from address matches the verified domain exactly
Your email content isn't triggering spam filters — avoid ALL CAPS subject lines, excessive links, or spam trigger words
You're not sending to addresses that have previously bounced or complained — check your suppression list
Your domain has a positive sending history — start with low volumes and ramp up

Do I have to use a subdomain?

You can verify an apex domain (e.g. yourdomain.com), but we recommend a subdomain like mail.yourdomain.com. This keeps your transactional email DNS records separate from your website and avoids conflicts with existing SPF records.