Domains

A domain belongs to a project and sends through that project's connection (or the connection_id you pass). The connection must be connected; otherwise adding a domain answers 409 connection_not_ready. Adding one creates an SES domain identity in your account, tagged stamp0:connection=<connection>, with a custom MAIL FROM, and returns the DNS records right away.

If SES already has an identity for that domain that Stamp0 did not create, Stamp0 never takes it over: the request fails with 409 conflict until you delete that identity in SES. Deleting a domain in Stamp0 deletes only the identity Stamp0 created.

RecordsCopy Anchor Link

Automatic DNSCopy Anchor Link

If the domain's hosted zone is on Route 53 in the connected account and the stack was installed with Let Stamp0 manage Route 53 DNS records, Stamp0 publishes the DKIM, DMARC and MAIL FROM records itself (MAIL FROM on send. or bounce.). It never overwrites a record you already have, except to add the SPF value to an existing TXT set, and it never touches the apex MX or other names: add the receiving and tracking records yourself. The domain's dns_automation shows what was published, what was already there, and what is left to you. For any other DNS provider, copy the records from the dashboard or the API.

Stamp0 then checks the domain, quickly at first and then hourly, until SES reports it verified (SES gives up after 72 hours). POST /domains/:id/verify starts checking again right away.

StatusesCopy Anchor Link

not_started → pending → verified. A domain is partially_verified while DKIM passes and MAIL FROM does not yet, failed when SES gave up (or the identity belongs to something else in your account), and temporary_failure when SES could not look up the records.

Tracking and TLSCopy Anchor Link

Open and click tracking, a custom tracking subdomain and enforced TLS are per domain. Stamp0 keeps them in an SES configuration set of the domain's own, which needs the Stamp0 stack at v1.4.0 or later; on an older stack tracking_status is stack_update_required and the domain tracks opens and clicks with opportunistic TLS until you update the stack.

{ "open_tracking": true, "click_tracking": true, "tracking_subdomain": "links", "tls": "enforced" }

ReceivingCopy Anchor Link

Set capabilities.receiving to enabled. Receiving rules live in your stack, so the domain's receiving.setup shows what is left: a stack update that adds the domain to InboundRecipients (exact parameters, a console link and an AWS CLI command), or activating the Stamp0 receipt rule set. Stamp0 turns receiving on as soon as that is done.

A domain receives on its sending connection unless you name another with receiving_connection_id, on either provider. On a Cloudflare connection, receiving turns on Email Routing for the name with a setup token, and each inbox address gets its own routing rule.

Turning sending offCopy Anchor Link

Set capabilities.sending to disabled to stop a domain from sending without deleting it. New sends from it answer 403 validation_error, and an email already scheduled from it fails with the reason domain_sending_disabled when its time comes.

SendersCopy Anchor Link

A sender is a from address on the domain with a display name and reply-to addresses: POST /domains/:id/senders with { "email": "hello@acme.co", "name": "Acme", "reply_to": "support@acme.co" }. Its from is ready to use in POST /emails.

Via the APICopy Anchor Link

curl https://api.stamp0.com/domains \
  -H "Authorization: Bearer $STAMP0_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "acme.co", "custom_return_path": "send" }'

The CLI does the same with stamp0 domains create acme.co and the MCP tool stamp0.domains.setup runs the whole flow for an agent. Reference: Create a domain, Update a domain, Verify a domain.