Domains

Production email requires a verified sending domain. Truncus supports per-tenant domain configuration.

Step 1 — Add your domain

Dashboard → Domains → Add domain

Enter your sending domain:

yourapp.com

Truncus will generate the DNS records you need to add.

Step 2 — Configure DNS

Add the records below to the DNS of your sending domain. Several of them contain tokens that are unique to your domain: copy those exact names and values from Dashboard → Domains → your domain. In the examples, yourapp.com stands for your sending domain (this can also be a subdomain such as mail.yourapp.com).

Verification (required)

Type: TXT
Name: _amazonses.yourapp.com
Value: [verification token, shown in dashboard]

SPF (required)

Type: TXT
Name: yourapp.com
Value: v=spf1 include:amazonses.com include:_spf.tem.scaleway.com ~all

A domain may carry only one SPF record. If your domain already has a v=spf1 record, do not add a second one: fold include:amazonses.com and include:_spf.tem.scaleway.com into the existing record instead. Two v=spf1 records break SPF for the whole domain.

DKIM

DKIM uses three CNAME records. Each one contains a token that is unique to your domain, so the exact names and targets are shown in your dashboard.

Type: CNAME
Name: [token 1]._domainkey.yourapp.com
Value: [token 1].dkim.amazonses.com

Type: CNAME
Name: [token 2]._domainkey.yourapp.com
Value: [token 2].dkim.amazonses.com

Type: CNAME
Name: [token 3]._domainkey.yourapp.com
Value: [token 3].dkim.amazonses.com

Cloudflare: set all three DKIM CNAME records to DNS only (grey cloud), not Proxied. A proxied DKIM record does not resolve to its target, and DKIM fails.

Once your domain is provisioned on the EU failover leg (Scaleway TEM), the dashboard also shows one additional Scaleway DKIM TXT record. Copy its name and value from the dashboard as well. Failover works where a domain is authenticated with both providers.

DMARC (recommended)

Type: TXT
Name: _dmarc.yourapp.com
Value: v=DMARC1; p=none

Optionally add rua=mailto:you@yourapp.com to receive aggregate reports.

Start with p=none. Move to p=quarantine or p=reject once you confirm legitimate traffic is aligned.

MX (optional, inbound only)

Only needed if you want to receive email on this domain. The dashboard shows the exact host.

Type: MX
Name: yourapp.com
Priority: 10
Value: [inbound host, shown in dashboard]

Step 3 — Verify

Delegated domains are verified automatically in the background. Other domains are verified while the dashboard is open, or when you re-check them from the dashboard.

Typical propagation time: 1–5 minutes with Cloudflare. Up to 48 hours with legacy registrars.

Verification status is visible in the dashboard under Domains.

Daily sending cap and warm-up

Every sending domain has a fixed daily sending cap. The cap for your domain is shown in your dashboard under Domains. When a domain reaches its cap, further sends are rejected with WARMUP_CAP_EXCEEDED until the cap resets at midnight UTC.

Truncus does not raise the cap automatically over time. Warming up a new domain is up to you: start with a small daily volume and increase it gradually over the first days and weeks, staying within the cap.

Why warm-up matters

Mailbox providers monitor sending patterns for new domains. A sudden spike from an unknown domain triggers spam classification.

Gradual ramp-up builds a clean sending reputation before reaching full volume.

Multi-tenant domains

Platforms sending email on behalf of their customers can configure per-customer domains.

customerA.com
customerB.com
customerC.com

Each domain maintains independent reputation and suppression lists. A bounce on customerA.com does not affect customerB.com.

See Delivery model → for how suppression lists work.

Shared domain (development)

On the Free plan, you can send from mail.truncus.co without domain configuration. Recommended only for testing.

Production sends should always use a verified domain for deliverability and brand consistency.

Removing a domain

To remove a sending domain, call DELETE /v1/domains/{id} with an API key that has both the read_domains and send scopes. You can only remove domains that belong to your own project.

curl -X DELETE https://truncus.co/api/v1/domains/dom_123 \
  -H "Authorization: Bearer tr_live_..."

Removing a domain does the following:

Deletes its SES sender identity.
Releases its Scaleway TEM slot, if one was held.
Clears the domain's operational alert rows.
Soft-deletes the domain and frees the domain slot on your plan. The domain stops sending and disappears from your account.

The call is idempotent: a domain that is unknown or already removed returns 404, and a domain owned by another project returns 403.

What is retained: your send logs and suppression records are kept as your audit trail, in line with the retention policy. They are not deleted when you remove a domain. Retained suppression records continue to protect your other sending from addresses that previously bounced or complained.