Mail API.

User-set values only (null when the workspace has never customised). Null fields signal "not customised — falling through to default".

Display name shown in the email header (falls back to your workspace display name if not set).

Primary brand color. Used for buttons, links, and accent strokes. Hex string (e.g. #2d29d7).

Secondary brand color, typically darker than primary. Used for hover states + secondary accents.

Body text color (default: near-black).

Muted text color for footers + secondary copy.

Page background — the area outside the email card.

Email card background.

CSS font-family stack. Email clients can't use webfonts reliably — list system fonts in fallback order.

CSS length value for button border-radius (e.g. "6px", "0", "9999px" for fully round).

Maximum width of the email card. Bulletproof tables max-out at this.

Custom HTML to render in the email footer. Inline styles only — no <style> tags. Used by templates that opt into `{{> bp.footer}}`.

Postal address line for compliance footers (CAN-SPAM, etc.). Plain text, displayed verbatim.

Map of social-platform → URL. Recognized keys: twitter, x, linkedin, github, instagram, facebook, youtube, tiktok, mastodon, bluesky, web. Keys are stored and returned exactly as sent.

Extra key/value tokens addressable as {{brand.extras.<key>}} in templates. Use for marketing strings, secondary accent colors, etc. Keys are stored and returned exactly as sent (`hero_title` stays `hero_title`, `heroTitle` stays `heroTitle`), so `<key>` is the key you sent.

Example: {"hero_title":"Spring sale"}

User-set values only (null when the workspace has never customised). Null fields signal "not customised — falling through to default".

Lookback used, in days.

Example: 14

Messages handed off for delivery in the window.

Example: 80

Messages still waiting to be handed off.

Example: 0

Messages with recipient-side evidence of arrival. Zero across the estate today — nothing emits that evidence yet, and reporting zero is the honest answer rather than assuming success.

Example: 0

bounced + complained + failed + deferred.

Example: 7

Messages currently deferred.

Example: 235

Messages hard-bounced.

Example: 7

negative / left_queue.

Example: 0.0875

confirmed / left_queue.

Example: 0

Diagnostics that matched a known reputation-block signature.

One actionable sentence.

Example: "80 message(s) were handed off and none has been confirmed as arriving."

Each sending domain with its DMARC grade. Gmail and Yahoo require DMARC from bulk senders, so a domain with `dmarc.location = none` is a deliverability risk regardless of the verdict.

Only messages in any of these statuses. Repeat the parameter (`status=bounced&status=complained`), use the bracket form (`status[]=bounced&status[]=complained`) or comma-separate the values (`status=bounced,complained`); a single value is the original single-status filter.

Only messages sent from this domain (`domain.id`).

Only messages sent with this Platform API Key. Recorded from 2026-10-12; older messages have no key.

How the message was sent: `api_key` (a Platform API Key), `dashboard` (a signed-in person, in the console or through MCP), `platform` (in-cluster product mail), `test_send` (a template test send). Recorded from 2026-10-12; older messages all read `platform`.

Filter by template name.

Only messages created at or after this instant. With `created_before`, the window may span at most 30 days (the log retention).

Only messages created before this instant. Without `created_after`, the window is the 30 days before it.

Legacy: filter by exact recipient address. Prefer `q`.

Legacy: substring filter on subject (case-insensitive, max 200 chars). Prefer `q`.

Page size, 1–100

Opaque cursor from the previous page's `pagination.next_cursor`. Omit for the first page.

Only messages in any of these statuses. Repeat the parameter (`status=bounced&status=complained`), use the bracket form (`status[]=bounced&status[]=complained`) or comma-separate the values (`status=bounced,complained`); a single value is the original single-status filter.

Only messages sent from this domain (`domain.id`).

Only messages sent with this Platform API Key. Recorded from 2026-10-12; older messages have no key.

How the message was sent: `api_key` (a Platform API Key), `dashboard` (a signed-in person, in the console or through MCP), `platform` (in-cluster product mail), `test_send` (a template test send). Recorded from 2026-10-12; older messages all read `platform`.

Filter by template name.

Only messages created at or after this instant. With `created_before`, the window may span at most 30 days (the log retention).

Only messages created before this instant. Without `created_after`, the window is the 30 days before it.

Legacy: filter by exact recipient address. Prefer `q`.

Legacy: substring filter on subject (case-insensitive, max 200 chars). Prefer `q`.

The sending domain (`domain.id`). Null for rows whose domain was deleted.

The Platform API Key that sent the message. Null for console, platform, MCP and test sends without a key, and unknown (null) for messages created before 2026-10-12.

Example: "9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d"

How the message was sent: `api_key`, `dashboard`, `platform` or `test_send`. Unknown for messages created before 2026-10-12, which all read `platform`.

Example: "api_key"

Bounce type, when the message bounced or was deferred: `Permanent`, `Transient` or `Undetermined`. `Permanent` adds the recipient to the suppression list.

Example: "Permanent"

Bounce subtype, e.g. `General`, `NoEmail`, `Suppressed`, `MailboxFull`.

Example: "General"

How the message was sent: `ses` (delivery tracking: delivery, bounces and complaints reported) or `smtp` (sent before delivery tracking started or through a custom SMTP relay: hand-off confirmed, delivery not measurable). Null until the send is acknowledged.

Example: "ses"

When the message was handed off for delivery. This is the fact the send path actually establishes.

When the message was confirmed delivered to the recipient. Null unless there is recipient-side evidence — a hand-off is not delivery.

Most recent deferral. Set when the destination refused to take the message for now and delivery is still being retried.

How many times a destination has refused to take this message. The count is the operator-legible number, not the flag: one greylist is noise, a dozen on the same recipient is a reputation block.

Example: 0

The email (`POST /emails` or a template send) this message belongs to: one email, one message per recipient (`GET /emails/{id}`). Null for messages sent before 2026-11-06.

The email's Cc list, as sent; null when none.

The email's Bcc list, as sent; null when none.

The email's Reply-To list, as sent; null when none.

The email's tags (`[{ name, value }]`); null when none.

Every recorded transition, oldest first (at most 200).

The most recent event, or null for a row that predates event recording.

The sending domain (`domain.id`). Null for rows whose domain was deleted.

The Platform API Key that sent the message. Null for console, platform, MCP and test sends without a key, and unknown (null) for messages created before 2026-10-12.

Example: "9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d"

How the message was sent: `api_key`, `dashboard`, `platform` or `test_send`. Unknown for messages created before 2026-10-12, which all read `platform`.

Example: "api_key"

Bounce type, when the message bounced or was deferred: `Permanent`, `Transient` or `Undetermined`. `Permanent` adds the recipient to the suppression list.

Example: "Permanent"

Bounce subtype, e.g. `General`, `NoEmail`, `Suppressed`, `MailboxFull`.

Example: "General"

How the message was sent: `ses` (delivery tracking: delivery, bounces and complaints reported) or `smtp` (sent before delivery tracking started or through a custom SMTP relay: hand-off confirmed, delivery not measurable). Null until the send is acknowledged.

Example: "ses"

When the message was handed off for delivery. This is the fact the send path actually establishes.

When the message was confirmed delivered to the recipient. Null unless there is recipient-side evidence — a hand-off is not delivery.

Most recent deferral. Set when the destination refused to take the message for now and delivery is still being retried.

How many times a destination has refused to take this message. The count is the operator-legible number, not the flag: one greylist is noise, a dozen on the same recipient is a reputation block.

Example: 0

The email (`POST /emails` or a template send) this message belongs to: one email, one message per recipient (`GET /emails/{id}`). Null for messages sent before 2026-11-06.

The email's Cc list, as sent; null when none.

The email's Bcc list, as sent; null when none.

The email's Reply-To list, as sent; null when none.

The email's tags (`[{ name, value }]`); null when none.

Cleartext HTML body. Null when the workspace has `redact_bodies = true`.

Cleartext text body. Null when the workspace has `redact_bodies = true`.

Opaque cursor from the previous page's `pagination.next_cursor`. Omit for the first page.

Case-insensitive substring match on the domain fqdn.

Filter by `verification_status` (`not_started`, `pending`, `partially_verified`, `verified`, `temporary_failure`, `failed`, `disabled`), applied in the query so the cursor keeps its meaning. The legacy `status` value `active` is still accepted and matches `status = active`. `pending` now means the `verification_status` (checked, not verified yet, within 72 h); before 2026-10 it matched `status = pending`, which is `not_started`, `pending`, `partially_verified` and the pending part of `failed`. Unrecognised values are rejected with a 400.

Only `false` for now; `true` is refused with 422 `TRACKING_NOT_AVAILABLE`.

Example: false

Only `false` for now; `true` is refused with 422 `TRACKING_NOT_AVAILABLE`.

Example: false

Not available yet: any value is refused with 422 `TRACKING_NOT_AVAILABLE`.

Fully qualified domain name. Required unless `name` is sent.

Example: "mail.example.com"

Resend's name for `fqdn`. Send either; both must agree when both are sent.

Example: "mail.example.com"

How the workspace plans to use this domain; drives which DNS records gate verification. Defaults to `send` (Resend's default: sending on, receiving off). Same as `capabilities`; send one or the other, or both in agreement.

Resend's shape of `intent`: `sending` defaults to `enabled`, `receiving` to `disabled`; at least one must be enabled.

The AWS region to send from. Every domain of this deployment sends from the same region (`region` on any domain, e.g. `eu-north-1`); any other value is refused with 422 `REGION_NOT_AVAILABLE`.

Example: "eu-north-1"

Resend's name for `mail_from_subdomain`: the custom MAIL FROM (return-path) label, `bounce` → `bounce.<fqdn>`. Sending domains only; defaults to `bounce`. Refused with 409 `MAIL_FROM_HOST_IN_USE` when that host already has records that are not ours.

Example: "bounce"

Sequential id per workspace.

Example: "3"

Example: "productcraft.co"

Same as `fqdn` (Resend's field name).

Example: "productcraft.co"

How the workspace uses this domain; `capabilities` is the same thing in Resend's shape. Changeable with PATCH.

TLS on delivery to the receiving server. Always `opportunistic` today (TLS whenever the receiver offers it); `enforced` is not available yet.

Example: "opportunistic"

Open tracking. Always false: tracking is not available yet.

Example: false

Click tracking. Always false: tracking is not available yet.

Example: false

Tracking subdomain. Always null: tracking is not available yet.

Example: null

Example: "pending"

Drift on a verified domain. `degraded`: a required record (DKIM, or MX for receiving) went missing or changed, or DKIM signing no longer verifies; mail still flows and workspace owners are emailed. `failing`: still degraded 72 h later; sends from the domain are refused with 422 `domain_not_verified_by_provider`. Back to `ok` as soon as the records are. A failed DNS lookup never changes it, and recommended records (MAIL FROM, DMARC) never do. Always `ok` while the domain is not `active`.

Example: "ok"

When `health` last changed; null if it has always been `ok`.

While `health` is `degraded`: when the 72 h grace ends and the domain becomes `failing` unless the records are back. Null otherwise.

Ownership token for the `_productcraft-verify` TXT. Issued for receive-only domains; sending domains prove ownership with their DKIM record, so it is null for send/both domains created since 2026-10.

Public DKIM key in PEM form (private half stays server-side).

The effective DNS provider: the user's choice when set, otherwise the one detected from the zone's NS records; null when neither is known. Changed in 2026-10 from the raw id string, which is now `dns_provider_id`.

The provider id chosen in the setup wizard (PATCH `dns_provider`), or null when not chosen. Kept for one release for clients that read the old string `dns_provider`; use `dns_provider.id`.

Example: "cloudflare"

DNS provider detected from the zone's NS records when the domain was added; `dns_provider` reports the effective one.

One status in Resend's vocabulary, derived from `status`, `health`, `intent` and the record states; first match wins. `disabled`: the domain is disabled. `failed`: `health` is `failing`, or still pending 72 h after it was added. `temporary_failure`: verified, but a required record went missing or changed (`health = degraded`, within the 72 h grace). `verified`: active and healthy. `partially_verified`: a send + receive domain where exactly one of sending (DKIM, and DKIM signing) and receiving (MX) verifies. `pending`: checked at least once, not verified yet. `not_started`: not checked yet. Recommended records (MAIL FROM, DMARC) never change it; see `recommended_pending`.

Example: "pending"

Recommended records (custom MAIL FROM MX + SPF, DMARC) that are not verified yet. Informational; they never block the domain.

Example: 2

The region mail from this domain is sent from, e.g. `eu-north-1`. Read-only and the same for every domain of this deployment; null when not configured.

Example: "eu-north-1"

Display name of `region`.

Example: "Stockholm"

Snapshot of the most recent DNS check (any shape).

Zone apex found by walking SOA records up from the fqdn; null before the first check.

Example: "example.com"

DKIM signing verification of this domain, mirrored on every check. `not_enabled` where sending verification is off in this environment (local, preview); null while the domain is not registered for signing yet.

Custom MAIL FROM label (`bounce` → `bounce.<fqdn>`); null when off. On by default for sending domains created since 2026-10.

Example: "bounce"

Verification of the custom MAIL FROM host (its MX record); null when no custom MAIL FROM is configured.

false when the customer opted out of our `_dmarc` recommendation (PATCH `dmarc_managed`).

Example: true

How the DNS records were last set up by an automated path: `provider_api` after `POST .../dns-records/apply` wrote them with a provider token, `domain_connect` after a Domain Connect flow. Null when the records were (or are being) added by hand.

Example: null

The DMARC policy that governs this domain, graded on the last check; null before the first check of a sending domain.

DNS records to publish for this domain's intent. Records with `required: true` gate `active`; the rest are informational.

The same records in Resend's `records[]` shape, each with its status.

Convenience accessor for the test-email mailbox address on this domain.

Example: "test-abc123@productcraft.co"

Zone apex found by walking SOA records; null when the domain does not resolve.

Example: "acme.com"

A better name to send from when an apex was typed: `mail.<apex>`, or `send.<apex>` when `mail.` already has other records.

Records already there that will matter.

Sequential id per workspace.

Example: "3"

Example: "productcraft.co"

Same as `fqdn` (Resend's field name).

Example: "productcraft.co"

How the workspace uses this domain; `capabilities` is the same thing in Resend's shape. Changeable with PATCH.

TLS on delivery to the receiving server. Always `opportunistic` today (TLS whenever the receiver offers it); `enforced` is not available yet.

Example: "opportunistic"

Open tracking. Always false: tracking is not available yet.

Example: false

Click tracking. Always false: tracking is not available yet.

Example: false

Tracking subdomain. Always null: tracking is not available yet.

Example: null

Example: "pending"

Drift on a verified domain. `degraded`: a required record (DKIM, or MX for receiving) went missing or changed, or DKIM signing no longer verifies; mail still flows and workspace owners are emailed. `failing`: still degraded 72 h later; sends from the domain are refused with 422 `domain_not_verified_by_provider`. Back to `ok` as soon as the records are. A failed DNS lookup never changes it, and recommended records (MAIL FROM, DMARC) never do. Always `ok` while the domain is not `active`.

Example: "ok"

When `health` last changed; null if it has always been `ok`.

While `health` is `degraded`: when the 72 h grace ends and the domain becomes `failing` unless the records are back. Null otherwise.

Ownership token for the `_productcraft-verify` TXT. Issued for receive-only domains; sending domains prove ownership with their DKIM record, so it is null for send/both domains created since 2026-10.

Public DKIM key in PEM form (private half stays server-side).

The effective DNS provider: the user's choice when set, otherwise the one detected from the zone's NS records; null when neither is known. Changed in 2026-10 from the raw id string, which is now `dns_provider_id`.

The provider id chosen in the setup wizard (PATCH `dns_provider`), or null when not chosen. Kept for one release for clients that read the old string `dns_provider`; use `dns_provider.id`.

Example: "cloudflare"

DNS provider detected from the zone's NS records when the domain was added; `dns_provider` reports the effective one.

One status in Resend's vocabulary, derived from `status`, `health`, `intent` and the record states; first match wins. `disabled`: the domain is disabled. `failed`: `health` is `failing`, or still pending 72 h after it was added. `temporary_failure`: verified, but a required record went missing or changed (`health = degraded`, within the 72 h grace). `verified`: active and healthy. `partially_verified`: a send + receive domain where exactly one of sending (DKIM, and DKIM signing) and receiving (MX) verifies. `pending`: checked at least once, not verified yet. `not_started`: not checked yet. Recommended records (MAIL FROM, DMARC) never change it; see `recommended_pending`.

Example: "pending"

Recommended records (custom MAIL FROM MX + SPF, DMARC) that are not verified yet. Informational; they never block the domain.

Example: 2

The region mail from this domain is sent from, e.g. `eu-north-1`. Read-only and the same for every domain of this deployment; null when not configured.

Example: "eu-north-1"

Display name of `region`.

Example: "Stockholm"

Snapshot of the most recent DNS check (any shape).

Zone apex found by walking SOA records up from the fqdn; null before the first check.

Example: "example.com"

DKIM signing verification of this domain, mirrored on every check. `not_enabled` where sending verification is off in this environment (local, preview); null while the domain is not registered for signing yet.

Custom MAIL FROM label (`bounce` → `bounce.<fqdn>`); null when off. On by default for sending domains created since 2026-10.

Example: "bounce"

Verification of the custom MAIL FROM host (its MX record); null when no custom MAIL FROM is configured.

false when the customer opted out of our `_dmarc` recommendation (PATCH `dmarc_managed`).

Example: true

How the DNS records were last set up by an automated path: `provider_api` after `POST .../dns-records/apply` wrote them with a provider token, `domain_connect` after a Domain Connect flow. Null when the records were (or are being) added by hand.

Example: null

The DMARC policy that governs this domain, graded on the last check; null before the first check of a sending domain.

DNS records to publish for this domain's intent. Records with `required: true` gate `active`; the rest are informational.

The same records in Resend's `records[]` shape, each with its status.

Convenience accessor for the test-email mailbox address on this domain.

Example: "test-abc123@productcraft.co"

The latest 20 domain events, newest first. Page through all of them with `GET .../domains/{id}/events`.

Only `false` for now; `true` is refused with 422 `TRACKING_NOT_AVAILABLE`.

Example: false

Only `false` for now; `true` is refused with 422 `TRACKING_NOT_AVAILABLE`.

Example: false

Not available yet: any value is refused with 422 `TRACKING_NOT_AVAILABLE`.

Change how the domain is used. On a verified domain, a capability it gains must verify first: its records are checked live and the change is refused with 409 `CAPABILITY_NOT_VERIFIED` (records to publish in `details.records`) until they pass. Dropping receiving is refused with 409 `DOMAIN_HAS_MAILBOXES` while active mailboxes exist (listed in `details.mailboxes`). Same as `capabilities`; send one or the other, or both in agreement.

Resend's shape of `intent`. Omitted fields keep their current value; at least one must stay enabled.

Identifier from the wizard's provider list. Free-form so we can ship new entries without a migration. NULL clears the choice.

Custom MAIL FROM label: one DNS label, so `bounce` makes the envelope sender `…@bounce.<fqdn>` and SPF align with the From domain. `null` turns the custom MAIL FROM off (the default return address is used; DKIM still aligns). Sending domains only.

Example: "bounce"

false: do not recommend a `_dmarc` record for this domain (DMARC is managed elsewhere). The policy that applies is still detected and graded in `dmarc_grade`.

Example: false

Sequential id per workspace.

Example: "3"

Example: "productcraft.co"

Same as `fqdn` (Resend's field name).

Example: "productcraft.co"

How the workspace uses this domain; `capabilities` is the same thing in Resend's shape. Changeable with PATCH.

TLS on delivery to the receiving server. Always `opportunistic` today (TLS whenever the receiver offers it); `enforced` is not available yet.

Example: "opportunistic"

Open tracking. Always false: tracking is not available yet.

Example: false

Click tracking. Always false: tracking is not available yet.

Example: false

Tracking subdomain. Always null: tracking is not available yet.

Example: null

Example: "pending"

Drift on a verified domain. `degraded`: a required record (DKIM, or MX for receiving) went missing or changed, or DKIM signing no longer verifies; mail still flows and workspace owners are emailed. `failing`: still degraded 72 h later; sends from the domain are refused with 422 `domain_not_verified_by_provider`. Back to `ok` as soon as the records are. A failed DNS lookup never changes it, and recommended records (MAIL FROM, DMARC) never do. Always `ok` while the domain is not `active`.

Example: "ok"

When `health` last changed; null if it has always been `ok`.

While `health` is `degraded`: when the 72 h grace ends and the domain becomes `failing` unless the records are back. Null otherwise.

Ownership token for the `_productcraft-verify` TXT. Issued for receive-only domains; sending domains prove ownership with their DKIM record, so it is null for send/both domains created since 2026-10.

Public DKIM key in PEM form (private half stays server-side).

The effective DNS provider: the user's choice when set, otherwise the one detected from the zone's NS records; null when neither is known. Changed in 2026-10 from the raw id string, which is now `dns_provider_id`.

The provider id chosen in the setup wizard (PATCH `dns_provider`), or null when not chosen. Kept for one release for clients that read the old string `dns_provider`; use `dns_provider.id`.

Example: "cloudflare"

DNS provider detected from the zone's NS records when the domain was added; `dns_provider` reports the effective one.

One status in Resend's vocabulary, derived from `status`, `health`, `intent` and the record states; first match wins. `disabled`: the domain is disabled. `failed`: `health` is `failing`, or still pending 72 h after it was added. `temporary_failure`: verified, but a required record went missing or changed (`health = degraded`, within the 72 h grace). `verified`: active and healthy. `partially_verified`: a send + receive domain where exactly one of sending (DKIM, and DKIM signing) and receiving (MX) verifies. `pending`: checked at least once, not verified yet. `not_started`: not checked yet. Recommended records (MAIL FROM, DMARC) never change it; see `recommended_pending`.

Example: "pending"

Recommended records (custom MAIL FROM MX + SPF, DMARC) that are not verified yet. Informational; they never block the domain.

Example: 2

The region mail from this domain is sent from, e.g. `eu-north-1`. Read-only and the same for every domain of this deployment; null when not configured.

Example: "eu-north-1"

Display name of `region`.

Example: "Stockholm"

Snapshot of the most recent DNS check (any shape).

Zone apex found by walking SOA records up from the fqdn; null before the first check.

Example: "example.com"

DKIM signing verification of this domain, mirrored on every check. `not_enabled` where sending verification is off in this environment (local, preview); null while the domain is not registered for signing yet.

Custom MAIL FROM label (`bounce` → `bounce.<fqdn>`); null when off. On by default for sending domains created since 2026-10.

Example: "bounce"

Verification of the custom MAIL FROM host (its MX record); null when no custom MAIL FROM is configured.

false when the customer opted out of our `_dmarc` recommendation (PATCH `dmarc_managed`).

Example: true

How the DNS records were last set up by an automated path: `provider_api` after `POST .../dns-records/apply` wrote them with a provider token, `domain_connect` after a Domain Connect flow. Null when the records were (or are being) added by hand.

Example: null

The DMARC policy that governs this domain, graded on the last check; null before the first check of a sending domain.

DNS records to publish for this domain's intent. Records with `required: true` gate `active`; the rest are informational.

The same records in Resend's `records[]` shape, each with its status.

Convenience accessor for the test-email mailbox address on this domain.

Example: "test-abc123@productcraft.co"

Opaque cursor from the previous page's `pagination.next_cursor`. Omit for the first page.

Sequential id per workspace.

Example: "3"

Example: "productcraft.co"

Same as `fqdn` (Resend's field name).

Example: "productcraft.co"

How the workspace uses this domain; `capabilities` is the same thing in Resend's shape. Changeable with PATCH.

TLS on delivery to the receiving server. Always `opportunistic` today (TLS whenever the receiver offers it); `enforced` is not available yet.

Example: "opportunistic"

Open tracking. Always false: tracking is not available yet.

Example: false

Click tracking. Always false: tracking is not available yet.

Example: false

Tracking subdomain. Always null: tracking is not available yet.

Example: null

Example: "pending"

Drift on a verified domain. `degraded`: a required record (DKIM, or MX for receiving) went missing or changed, or DKIM signing no longer verifies; mail still flows and workspace owners are emailed. `failing`: still degraded 72 h later; sends from the domain are refused with 422 `domain_not_verified_by_provider`. Back to `ok` as soon as the records are. A failed DNS lookup never changes it, and recommended records (MAIL FROM, DMARC) never do. Always `ok` while the domain is not `active`.

Example: "ok"

When `health` last changed; null if it has always been `ok`.

While `health` is `degraded`: when the 72 h grace ends and the domain becomes `failing` unless the records are back. Null otherwise.

Ownership token for the `_productcraft-verify` TXT. Issued for receive-only domains; sending domains prove ownership with their DKIM record, so it is null for send/both domains created since 2026-10.

Public DKIM key in PEM form (private half stays server-side).

The effective DNS provider: the user's choice when set, otherwise the one detected from the zone's NS records; null when neither is known. Changed in 2026-10 from the raw id string, which is now `dns_provider_id`.

The provider id chosen in the setup wizard (PATCH `dns_provider`), or null when not chosen. Kept for one release for clients that read the old string `dns_provider`; use `dns_provider.id`.

Example: "cloudflare"

DNS provider detected from the zone's NS records when the domain was added; `dns_provider` reports the effective one.

One status in Resend's vocabulary, derived from `status`, `health`, `intent` and the record states; first match wins. `disabled`: the domain is disabled. `failed`: `health` is `failing`, or still pending 72 h after it was added. `temporary_failure`: verified, but a required record went missing or changed (`health = degraded`, within the 72 h grace). `verified`: active and healthy. `partially_verified`: a send + receive domain where exactly one of sending (DKIM, and DKIM signing) and receiving (MX) verifies. `pending`: checked at least once, not verified yet. `not_started`: not checked yet. Recommended records (MAIL FROM, DMARC) never change it; see `recommended_pending`.

Example: "pending"

Recommended records (custom MAIL FROM MX + SPF, DMARC) that are not verified yet. Informational; they never block the domain.

Example: 2

The region mail from this domain is sent from, e.g. `eu-north-1`. Read-only and the same for every domain of this deployment; null when not configured.

Example: "eu-north-1"

Display name of `region`.

Example: "Stockholm"

Snapshot of the most recent DNS check (any shape).

Zone apex found by walking SOA records up from the fqdn; null before the first check.

Example: "example.com"

DKIM signing verification of this domain, mirrored on every check. `not_enabled` where sending verification is off in this environment (local, preview); null while the domain is not registered for signing yet.

Custom MAIL FROM label (`bounce` → `bounce.<fqdn>`); null when off. On by default for sending domains created since 2026-10.

Example: "bounce"

Verification of the custom MAIL FROM host (its MX record); null when no custom MAIL FROM is configured.

false when the customer opted out of our `_dmarc` recommendation (PATCH `dmarc_managed`).

Example: true

How the DNS records were last set up by an automated path: `provider_api` after `POST .../dns-records/apply` wrote them with a provider token, `domain_connect` after a Domain Connect flow. Null when the records were (or are being) added by hand.

Example: null

The DMARC policy that governs this domain, graded on the last check; null before the first check of a sending domain.

DNS records to publish for this domain's intent. Records with `required: true` gate `active`; the rest are informational.

The same records in Resend's `records[]` shape, each with its status.

Convenience accessor for the test-email mailbox address on this domain.

Example: "test-abc123@productcraft.co"

Example: "mail.example.com"

Drift on a verified domain. `degraded`: a required record (DKIM, or MX for receiving) went missing or changed, or DKIM signing no longer verifies; mail still flows and workspace owners are emailed. `failing`: still degraded 72 h later; sends from the domain are refused with 422 `domain_not_verified_by_provider`. Back to `ok` as soon as the records are. A failed DNS lookup never changes it, and recommended records (MAIL FROM, DMARC) never do. Always `ok` while the domain is not `active`.

Example: "ok"

When `health` last changed; null if it has always been `ok`.

While `health` is `degraded`: when the 72 h grace ends and the domain becomes `failing` unless the records are back. Null otherwise.

Zone the relative names are rendered against: the `zone` query parameter, else the zone found by walking SOA records (null before the first check).

Example: "example.com"

BIND: the `$ORIGIN` names are relative to (the domain or one of its parents). Defaults to the detected zone, else the domain itself.

Include records that already verify.

Example: "mail.example.com"

Drift on a verified domain. `degraded`: a required record (DKIM, or MX for receiving) went missing or changed, or DKIM signing no longer verifies; mail still flows and workspace owners are emailed. `failing`: still degraded 72 h later; sends from the domain are refused with 422 `domain_not_verified_by_provider`. Back to `ok` as soon as the records are. A failed DNS lookup never changes it, and recommended records (MAIL FROM, DMARC) never do. Always `ok` while the domain is not `active`.

Example: "ok"

When `health` last changed; null if it has always been `ok`.

While `health` is `degraded`: when the 72 h grace ends and the domain becomes `failing` unless the records are back. Null otherwise.

Zone the relative names are rendered against: the `zone` query parameter, else the zone found by walking SOA records (null before the first check).

Example: "example.com"

Opaque cursor from the previous page's `pagination.next_cursor`. Omit for the first page.

Optional: email the link to these people (whoever manages the DNS). At most 5 recipients per domain per UTC day and 20 per workspace, counted across all links; over that the request is refused with 429 and no link is created. Each recipient gets their own email from ProductCraft with the domain name, the link and its expiry.

Example: ["it@example.com"]

`active` until `expires_at` or until revoked.

Example: "active"

Principal (`sub`) that created the link.

Last time the public page was opened (updated at most once a minute).

How many recipients the link was emailed to.

Example: 1

The page to send: a read-only setup page with the records, live status and downloads, no account needed. Shown only in this response; it cannot be retrieved again (only a hash is stored). When the request carried an `Idempotency-Key`, a retry with the same key within 24 h returns this same response.

Example: "https://console.productcraft.co/mail/setup/3q2-7wVdZ6xYb9mJk1Lr0pQs4tUv8wXyZaBcDeFgHiJ"

The same link as JSON (`GET /v1/public/domain-setup/{token}`), for scripts.

Example: "https://api.mail.productcraft.co/v1/public/domain-setup/3q2-7wVdZ6xYb9mJk1Lr0pQs4tUv8wXyZaBcDeFgHiJ"

Recipients the email was queued for (an address whose email could not be queued is left out).

Example: ["it@example.com"]

A short-lived API token for the provider, used for this request only and never stored, logged or returned. Cloudflare: an API token limited to this one zone with the **Zone → DNS → Edit** permission and a short expiry. DigitalOcean: a personal access token with custom scopes `domain:read`, `domain:create`, `domain:update` and a 1-hour expiry. Revoke it once the apply is done.

Example: "dop_v1_EXAMPLE_TOKEN_DO_NOT_USE"

The zone at the provider (the domain or one of its parents). Defaults to the closest parent zone the token can see.

Example: "example.com"

`true`: return the plan and change nothing. `false`: apply the plan and return what was written.

Example: true

Also add the recommended DMARC record (`_dmarc.<fqdn>` `v=DMARC1; p=none;`). Only ever planned when no DMARC policy applies at the domain or its organisational domain; an existing policy is never touched, whatever this says.

Example: true

Example: "mail.example.com"

Example: "cloudflare"

The provider zone the records go into.

Example: "example.com"

Example: true

Whether records were written (false on a dry run).

Example: false

Every conflict in the plan, flattened, with the record it belongs to.

`token_scope_broader_than_zone`: the token can see more than this zone; it worked, but revoke it now. `dmarc_lookup_failed`: we could not tell whether a DMARC policy applies, so DMARC was left out. `partially_applied`: some writes failed (see each item's `error`); run it again once fixed, finished records are skipped.

Example: ["token_scope_broader_than_zone"]

No DMARC policy applies to this domain, so the optional DMARC record can be added (`include_dmarc`).

Example: true

After an apply: the result of the DNS check run right away (new records are usually `propagating`). Null on a dry run.

The DNS provider the URL goes to, for the button label.

Example: "Cloudflare"

The zone the records are written into.

Example: "example.com"

A second confirmation for the DMARC record follows the first one at the provider.

Example: true

When the URL stops working (10 minutes).

Set by the provider when the user cancelled (`access_denied`) or the apply failed.

Provider-supplied detail; ignored.

Recipient of the test email. The suppression list is not checked for test sends; they count against the workspace test-send limit (30 per hour) instead of the send limits.

Example: "you@acme.com"

Always true on a 202.

Example: true

The From field as sent, display name included.

Example: "Acme <hello@acme.com>"

The `to` field as sent: one address, or the array.

Example: "user@example.com"

The email this send created (`GET /emails/{id}`): one email, one message per recipient. Equals `id` for a send whose first message was recorded.

Example: "4f8b2c1e-9a3d-4e57-b6f0-2d1c8e7a9b05"

`active` once the required records verify.

Zone the relative names are rendered against.

Example: "example.com"

When the records were last checked (every 5 minutes while the domain is pending, hourly once active).

When this link stops working.

BIND: the zone the names are relative to. Defaults to the detected zone, else the domain itself.

Include records that already verify.

Null for the workspace-default config; set for a per-domain override.

Last 4 chars of the active signing secret.

True while a previous signing secret is still being honoured (24h grace after rotation).

Set when auto-disabled after sustained failure.

Events the destination subscribes to: any name of the catalogue (`email.*`, `domain.*`, `suppression.*`; see `/webhooks/endpoints`), or a pre-042 `message.*` alias (`message.sent|delivered|deferred|bounced|complained|failed`, kept for one release), which is delivered under the alias name. Email events carry the message; `domain.*` events carry `data: { id, fqdn, status, health }`, where `health` is `ok | degraded | failing` (drift on a verified domain; `failing` = still broken 72 h later, sends refused). `domain.created` adds `intent` and `created_at`; `domain.verified` adds `verified_at`; `domain.updated` adds `changes: [{ purpose, from, to }]` (a record purpose such as `dkim`, `mx`, `mail_from_mx`, `dmarc` with its state `missing | mismatch | conflict | propagating | verified`, or `ses` / `ses_mail_from` with the signing / MAIL FROM check status) and fires only on a real change; `domain.deleted` is sent after the domain is removed.

Example: ["email.sent","email.bounced"]

Null for the workspace-default config; set for a per-domain override.

Last 4 chars of the active signing secret.

True while a previous signing secret is still being honoured (24h grace after rotation).

Set when auto-disabled after sustained failure.

Plaintext signing secret. Returned once on create / rotate; never reconstructable.

Null for the workspace-default config; set for a per-domain override.

Last 4 chars of the active signing secret.

True while a previous signing secret is still being honoured (24h grace after rotation).

Set when auto-disabled after sustained failure.

Plaintext signing secret. Returned once on create / rotate; never reconstructable.

Null for the workspace-default config; set for a per-domain override.

Last 4 chars of the active signing secret.

True while a previous signing secret is still being honoured (24h grace after rotation).

Set when auto-disabled after sustained failure.

Events the destination subscribes to: any name of the catalogue (`email.*`, `domain.*`, `suppression.*`; see `/webhooks/endpoints`), or a pre-042 `message.*` alias (`message.sent|delivered|deferred|bounced|complained|failed`, kept for one release), which is delivered under the alias name. Email events carry the message; `domain.*` events carry `data: { id, fqdn, status, health }`, where `health` is `ok | degraded | failing` (drift on a verified domain; `failing` = still broken 72 h later, sends refused). `domain.created` adds `intent` and `created_at`; `domain.verified` adds `verified_at`; `domain.updated` adds `changes: [{ purpose, from, to }]` (a record purpose such as `dkim`, `mx`, `mail_from_mx`, `dmarc` with its state `missing | mismatch | conflict | propagating | verified`, or `ses` / `ses_mail_from` with the signing / MAIL FROM check status) and fires only on a real change; `domain.deleted` is sent after the domain is removed.

Example: ["email.sent","email.bounced"]

Null for the workspace-default config; set for a per-domain override.

Last 4 chars of the active signing secret.

True while a previous signing secret is still being honoured (24h grace after rotation).

Set when auto-disabled after sustained failure.

Plaintext signing secret. Returned once on create / rotate; never reconstructable.

Null for the workspace-default config; set for a per-domain override.

Last 4 chars of the active signing secret.

True while a previous signing secret is still being honoured (24h grace after rotation).

Set when auto-disabled after sustained failure.

Plaintext signing secret. Returned once on create / rotate; never reconstructable.

Opaque cursor from the previous page's `pagination.next_cursor`. Omit for the first page.

Only the attempts for this event (`evt_<uuid>`).

Only the attempts made to this endpoint.

Always one page (an endpoint limit applies).