The three DNS records a sending subdomain needs, with the two mistakes people actually make taken out: pointing DMARC at the wrong host, and starting on a policy you cannot support yet.
_mcpmailer.agents.yourcompany.com
mcpmailer-verify=<token from the dashboard>
agents.yourcompany.com
10 inbound-smtp.eu-west-1.amazonaws.com
agents.yourcompany.com
v=spf1 include:amazonses.com ~all
_dmarc.agents.yourcompany.com
v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com; fo=1; adkim=s; aspf=s
<token>._domainkey.agents.yourcompany.com
<token>.dkim.amazonses.com
Three DKIM CNAMEs, issued when you add the domain. They cannot be derived from the name, and a domain is not activated until they resolve and a signature is confirmed.
Monitoring only. Nothing is rejected, and the reports tell you who else sends as this domain. Start here for two weeks.
Reputation is tracked per sending domain. Putting agents on agents.yourcompany.com rather than the domain your people send from
means an agent's bad week cannot take your invoices down with it, and it lets you publish strict
alignment, because nothing else sends from there.
Published records and passing messages are two different claims. Once these are live, check a real message with the header analyzer.
Read the full guide to agent subdomain authenticationA workspace comes with a working subdomain your agents can send from immediately. Verify your own domain later, with a wizard that checks each record as it resolves, and no agent code changes.
3,000 emails a month, free, no credit card.