​
Overview

Authenticating your domain is required to allow Userpilot to send emails on your behalf and provides the following benefits:
  • Protects against email spoofing.
  • Meets email clients’ sender requirements.
  • Enables reliable open / click tracking.
Required: Complete DKIM and MAIL FROM.
Recommended: Add DMARC and a link-tracking sub-domain for best deliverability.

​
Prerequisites

  • Access to your domain’s DNS (GoDaddy, Cloudflare, Route 53, Namecheap, …).
  • Decide on two sub-domains:
    • MAIL FROM (return-path): mail.yourdomain.com.
    • Link tracking (optional): tracking.yourdomain.com.

​
Authenticate DKIM + MAIL FROM (required)

1

Add your domain in Userpilot

  1. Open Settings → Email → Domains in the Userpilot dashboard.
  2. Click Add domain and enter yourdomain.com.
  3. For MAIL FROM enter mail.yourdomain.com.
  4. Click Create.
Pending domain authentication status

Domain just added – pending authentication

2

Create the DNS records

Copy the exact records displayed in the UI into your DNS.
DKIM → three CNAME records on the root domain.
SPF → one TXT record on mail.yourdomain.com containing v=spf1 include:amazonses.com ~all. MX → one MX record on mail.yourdomain.com (value & region shown in UI).You can only have one SPF TXT per domain. Merge includes, for example: "v=spf1 include:amazonses.com include:_spf.google.com ~all"
If you use Cloudflare, set all records to DNS Only. Proxying breaks verification.
3

Verify

DNS may take a few minutes (rarely up to 48 h).
Status switches to Authenticated when both DKIM and MAIL FROM are valid. You are now ready to send emails.
Domain authenticated status

Authenticated status

DMARC tells receivers what to do if SPF or DKIM fail and gives you reporting. 
_dmarc.yourdomain.com TXT "v=DMARC1; p=none;"
Start with p=none (monitor). Later you can move to quarantine or reject.
Using your own sub-domain to serve email link URLs keeps them brand-aligned and significantly improves deliverability. Some email clients will flag your emails as suspicious if link sources aren’t from your own domain.

​
Option A – Userpilot-Managed (Easiest)

1

Request a tracking sub-domain

Email support@userpilot.co with the sub-domain you want (e.g. tracking.yourdomain.com).
2

Add the CNAME we send you

We’ll provision SSL + CDN and reply with CNAME records. Add them to DNS and tell us once done.
3

Verification & go-live

Once the CNAME records resolve, we enable link branding automatically.

​
Option B – Bring your Own CDN (Advanced)

Origin: r.us-west-2.awstrack.me
  1. Create a CDN/edge distribution (e.g. CloudFront) for tracking.yourdomain.com pointing to the origin above based on your Userpilot account’s hosting region.
  2. Attach an SSL certificate for the sub-domain.
  3. Add CNAME tracking.yourdomain.com → your-cdn.cloudfront.net.
  4. Notify support@userpilot.co when ready.
Make sure the viewer protocol policy is HTTPS only and pass referer & user-agent headers.
You can find your Userpilot hosting region in the Environment page. If your HTTP endpoint is https://analytex-eu.userpilot.io/, you’re in the EU region.
curl -I https://tracking.yourdomain.com/favicon.ico
A 200 response with headers like below confirms the setup: 
x-amz-ses-region: us-west-2 # or eu-west-3
x-amz-ses-request-protocol: https

​
Troubleshooting