Custom Sending Domain
Send branded report emails from an address on your own domain
Overview
By default, branded report emails are sent from the Semaphor address, noreply@semaphor.cloud on Semaphor Cloud, with your From name in front of it. With a custom sending domain, they come from an address you choose, such as noreply@reports.respark.com, so recipients see your domain in the From line and replies, filters, and safe-sender rules work against it.
Setting it up takes one address, three required DNS records (plus two recommended ones), and one button press. You can complete those steps before saving email branding. The verified address starts sending immediately. If branding is configured, its name, logo, intro, footer, reply-to, and BCC continue to apply.
Custom sending domains are available on Semaphor Cloud and on self-hosted deployments that send through Amazon SES. Deployments that send through the bundled Resend provider configure their sending domain in Resend instead; see Provider differences.
Set up your domain
Open Brand Studio and switch to Email reports. Use your own domain is the outlined button in the Sender block's header, whether or not branding is saved yet; the From address row beneath it shows the address currently in use.
Enter the complete address
Type the full From address you want, for example reports@respark.com, then press Set up domain. You will need someone who can edit DNS for the domain. If you spot a typo later, you can start over from the same dialog.
Add the DNS records
The dialog now shows three CNAME records, then two records under Bounce domain (recommended): an MX record and a TXT record on bounce. followed by your domain. Add all five where DNS for your domain is managed, using the copy button next to each name and value, or Copy all records to hand the set to your DNS administrator. Verification usually completes within an hour of the records going live and can take up to 72 hours.
The three CNAME records verify the domain. The two bounce domain records are optional, but we recommend them; see Bounce domain.
Press Check again
Come back to the same dialog and press Check again. Semaphor asks the email service whether the domain is verified and stores the answer. Once the status is Verified, the next scheduled report and Briefing go out from your address.
Checking happens only when you press the button. Semaphor does not poll DNS in the background, and neither opening Brand Studio nor sending a report triggers a check.
What each status means
| Status | From address used | What to do |
|---|---|---|
| Pending | The Semaphor address | Add the DNS records and press Check again, or choose Start over after the records appear to enter a different address. If setup is still being recovered and no records appear, press Check again first. |
| Verified | Your configured address | Keep the DNS records in place, or choose Remove to return to the Semaphor address. |
| Failed | The Semaphor address | The email service looked for the records for 72 hours and stopped. Confirm the records are in place and press Check again: that restarts the search, and a second check a few minutes later usually shows Verified. Or choose Start over to enter a different address. |
While a domain is Pending or Failed, every other part of your branding still applies: the From name, logo, intro, footer, reply-to, and BCC. Only the address falls back. The From address row and the email preview always show the address in use.
After verification
Your address keeps working as long as the three CNAME records stay in DNS. Keep the bounce domain records too; if they are removed, emails go back to the default return address and still send. Check again remains available on the View details dialog, and it is the way to confirm the domain is still verified, for example after a DNS change on your side. If a check finds the domain no longer verified, the status becomes Failed and emails return to the Semaphor address until you fix the records and check again; a check from Failed restarts verification, so you do not have to set the domain up again.
If the records are removed but no one presses Check again, Semaphor continues to trust the last stored status and sends from your address; the email service then rejects those sends and the affected reports fail rather than going out from a different address. If reports stop arriving after a DNS change, open the dialog and press Check again.
Bounce domain
Every email carries two sender addresses: the From address recipients see, and a return address used for bounces. The CNAME records let receiving mail servers confirm, through a DKIM signature, that the email came from your domain. The two bounce domain records put the return address on your domain as well, so the email also passes SPF for your domain.
That matters to recipients whose mail filters change messages as they arrive, for example by tagging the subject or rewriting links. Those changes break the DKIM signature. If your domain publishes a strict DMARC policy (p=quarantine or p=reject) and SPF doesn't match your domain, such a filter can then quarantine the report as fraud. With the bounce domain records in place, SPF still matches your domain and DMARC passes.
| Type | Name | Value |
|---|---|---|
| MX | bounce.yourdomain.com | The value shown in the dialog, starting with 10 (the priority) |
| TXT | bounce.yourdomain.com | v=spf1 include:amazonses.com ~all |
If your DNS provider asks for the MX priority separately, enter 10 as the priority and the rest of the value as the mail server.
Until the bounce domain records are found, emails keep the default return address and still send normally. The domain's Verified status depends only on the CNAME records.
Domains verified earlier: open the dialog and press Check again. The bounce domain records then appear under the CNAME records.
When this isn't enough: SPF is checked against the server that delivers the email. If a recipient's mail passes through one filtering service and is then checked again by another system (for example, a gateway in front of Microsoft 365), that second check sees the gateway's server and SPF fails there too. That is fixed on the recipient's side: their administrator can trust the gateway's ARC results, enable enhanced filtering for the connector, or allow your sending domain.
Changing or removing the domain
For a Pending or Failed setup with DNS records, choose Start over and confirm the removal. If an interrupted setup has not returned records yet, press Check again to recover them before starting over. For a Verified domain, choose Remove, then confirm Remove custom domain. Report email returns to the Semaphor address immediately, and the dialog lets you enter another address after cleanup completes. If removal cannot be confirmed, the domain remains listed but inactive so you can safely retry.
Removing your email branding does not remove or deactivate the domain. Its status and DNS controls remain available, and a Verified address keeps sending without branding.
Provider differences
- Semaphor Cloud and self-hosted deployments on Amazon SES: the flow above applies. Semaphor creates the domain identity in its email service and gives you the DNS records.
- Self-hosted deployments on the bundled Resend provider: branding works exactly the same, but the sending domain is configured and verified in your Resend account, and the scheduler's
RESEND_SENDER_EMAILis the address used. If you press Use your own domain on such a deployment, Semaphor tells you to set up the sending domain in your email provider. See Reports, Briefings, and Scheduled Delivery.