Skip to content
Postern Postern Docs

Domains & onboarding

Where do mailboxes live? Postern gives you four onboarding modes, from zero-config to bring-your-own. The headline path — NS delegation — lets you put agents on mail.yourco.com by adding exactly one DNS record, then never touching DNS again.

The four modes

Section titled “The four modes”

1 · Shared subdomain

Default, zero-config. Mailboxes land on a pre-warmed, pre-verified shared mszazu.com subdomain — agent@<label>.mszazu.com. Instant. We steward reputation; abuse is bounded by credits and karma.

2 · NS delegation

The differentiator. Add one NS record pointing a subdomain at our nameservers. Our authoritative DNS then serves MX, SPF, DKIM, and DMARC for it — we control and rotate DKIM, you do no further DNS work.

3 · Buy through us

We register a domain on your behalf and auto-wire every record. The zero-DNS-work ideal — register-and-provision in one step. ops-assisted in V1

4 · Manual

The AgentMail-style fallback: we output the TXT / MX / DKIM records and you add them. De-emphasized — and CNAME-to-us is rejected because it breaks DKIM control.

NS delegation — the headline flow

Section titled “NS delegation — the headline flow”

The premise: most agentic-email products make you add a fistful of DNS records and re-add them whenever keys rotate. Postern asks for one NS record, then becomes authoritative for that subdomain so every other record — and every future DKIM rotation — happens on our side.

  1. Pick a subdomain you’ll dedicate to agents, e.g. mail.theirco.com. (Use a subdomain, never your apex — this keeps your main mail untouched.)

  2. Add one NS record at your registrar, delegating that subdomain to Postern’s nameservers:

    at your DNS provider
    mail.theirco.com.   NS   ns1.mszazu.com.
    mail.theirco.com.   NS   ns2.mszazu.com.

  3. Postern becomes authoritative. Our DNS server (postern-dns, built on miekg/dns, DB-backed) now answers for mail.theirco.com and serves the records mailboxes need:

    served by ns1/ns2.mszazu.com (automatic)
    mail.theirco.com.        MX    10 inbound.mszazu.com.
    mail.theirco.com.        TXT   "v=spf1 include:spf.mszazu.com -all"
    selector1._domainkey.mail.theirco.com.   CNAME   …acs-dkim…
    _dmarc.mail.theirco.com. TXT   "v=DMARC1; p=none; rua=mailto:dmarc@mszazu.com"

  4. Verification flips to verified. Once the NS delegation resolves and the served records are live, the domain’s verification_status and dkim_status go green — no per-record dance.

  5. Create mailboxes on it. domain: "mail.theirco.com" on any create now works, within the enrollment key’s allowed_domains.

Our authoritative DNS, in brief

Section titled “Our authoritative DNS, in brief”
PieceDetail
Nameserversns1.mszazu.com, ns2.mszazu.com (public, UDP/TCP 53)
Serverpostern-dns — Go, miekg/dns (the library CoreDNS is built on), DB-backed by dns_zones / dns_records
Why our ownDynamic, per-tenant records + programmatic DKIM rotation with full control — over a static zone file
Records servedA / MX / SPF / DKIM (CNAME) / DMARC for each delegated subdomain

Verification status

Section titled “Verification status”

Each onboarded domain carries a verification_status and a dkim_status:

StateMeaning
pendingDelegation/records not yet observed.
verifyingRecords seen; ACS verification in flight.
verifiedDomain is live; mailboxes can be created on it.
failedDelegation or DKIM didn’t resolve — re-check the NS record.

Manual mode (the fallback)

Section titled “Manual mode (the fallback)”

If you can’t delegate, Postern outputs the exact TXT / MX / DKIM records to add and verifies them. It’s supported but de-emphasized, and it loses the auto-rotation benefit. CNAME-to-us is rejected on purpose: it would hand DKIM control back to your DNS and break our ability to rotate keys.

Next

Section titled “Next”