White Labeling - Custom Email Domain

TL;DR

• What: OneLens sends product email (reports, alerts, invites) from your brand — [e-mail] instead of onelens-mail.com.

• Setup: DNS-only. You publish ~5 records on a dedicated mail subdomain; nothing to install, no servers, no keys shared.

• Scope: Limited to mail.yourdomain.com. Your root domain, website, and existing corporate email are never touched.

What You'll Get Once Connected

Capability	What it means for you
Branded sender	Emails arrive from [e-mail] with your name — no "via onelens-mail.com".
Inbox deliverability	Full SPF + DKIM + DMARC authentication, so mail lands in the inbox, not spam.
Anti-spoofing	The same records make it harder for anyone to impersonate your domain.
Zero maintenance	Signing keys are held and auto-rotated by AWS — set once, nothing to renew.

Security at a Glance

Your concern	Answer
Can OneLens send as our root @yourdomain.com?	No — only the mail.yourdomain.com subdomain.
Do you need access to our DNS?	No — you add the records yourself; we never touch your zone.
Do we share any private keys?	No — DKIM keys stay inside AWS; you publish only public pointers.
Can you read our incoming email?	No — the bounce record handles delivery reports only, not your inbox.
Will this change our existing email?	No — everything is on a separate subdomain.
Can we revoke it?	Yes — delete the records and sending stops immediately.

Cost of the Integration

Included in OneLens — there is no additional charge for branded email.

How It Works

1

We generate

OneLens creates a sending identity for your mail subdomain and hands you the exact DNS records.

2

You publish

Your team adds ~5 records to mail.yourdomain.com in your DNS.

3

We verify & send

Once the records are live, OneLens verifies the domain and starts sending your branded email. Bounces and complaints are monitored automatically.

Prerequisites

• A domain you control (e.g. yourdomain.com) and access to add DNS records.

• Agreement to use a mail subdomain — mail.yourdomain.com — as the sending identity.

• An active OneLens account; branded email enabled by your OneLens contact.

What OneLens Will Access

• Permission to cryptographically sign email for mail.yourdomain.com (DKIM).

• Delivery-status (bounce/complaint) notifications for that subdomain.

What OneLens Will NOT Access

• Your root domain or any other subdomain.

• Your DNS zone — you publish records yourself; this is not domain/NS delegation.

• Your inbound email or mailboxes — the bounce record is for delivery reports only.

• Any private keys or secrets — DKIM keys are generated and held by AWS SES.

Set It Up — DNS Records

Add these records to mail.yourdomain.com (OneLens gives you the exact CNAME values at onboarding):

#	Type	Host / Name	Value	Purpose
1–3	CNAME	<token>._domainkey.mail.yourdomain.com	<token>.dkim.amazonses.com	DKIM signing (3 records)
4	MX	bounce.mail.yourdomain.com	10 feedback-smtp.ap-south-1.amazonses.com	Bounce / return-path routing
5	TXT	bounce.mail.yourdomain.com	v=spf1 include:amazonses.com ~all	SPF authorization
6	TXT	_dmarc.mail.yourdomain.com	v=DMARC1; p=none; rua=mailto:[e-mail]	DMARC policy (recommended)

Add all of them. DKIM alone verifies the domain but leaves SPF unaligned — mail can still land in spam (Outlook especially). The MX + SPF (records 4–5) are what align SPF to your domain and drop the "via" label.

Verify It Worked

After the records propagate, OneLens confirms the domain shows DKIM verified, MAIL-FROM verified. On the receiving side, open any OneLens email → "Show original" and confirm:

• spf=pass (aligned to mail.yourdomain.com)

• dkim=pass

• dmarc=pass

• No "via onelens-mail.com" in the sender line.

Rotation & Maintenance

Nothing to do. AWS SES rotates the DKIM keys behind the CNAMEs automatically. Leave the records in place; if you ever migrate DNS providers, re-add the same records.

Data Privacy & Security

• Records are scoped to mail.yourdomain.com — your primary domain's mail policy is unchanged.

• No private keys leave AWS; you publish only public CNAME pointers.

• OneLens sends via a production, reputation-managed AWS SES account (region: ap-south-1, Mumbai).

• The setup is fully reversible — delete the records to stop branded sending.

Troubleshooting

Symptom	Fix
Domain stuck "pending" in OneLens	DNS not fully propagated — recheck the DKIM CNAMEs and the MX/SPF on bounce.mail...; allow up to a few hours.
Mail lands in Junk despite records	Confirm spf/dkim/dmarc = pass in the raw headers; a brand-new domain also needs a short warm-up period. Mark "Not Junk" once.
"via onelens-mail.com" still shows	The custom MAIL-FROM (records 4–5) isn't verified yet — check the MX + SPF on the bounce subdomain.
Bounces not visible	Ensure the MX record points to the correct region (feedback-smtp.ap-south-1.amazonses.com).

FAQ

Does this let OneLens send email as our root domain?

No. Only the mail.yourdomain.com subdomain is authorized. Your root domain is untouched.

Are you asking for access to our DNS?

No. You add ~5 records in your own DNS. OneLens never accesses your zone — this is deliberately not subdomain/NS delegation.

Do we hand over any private keys or secrets?

No. DKIM keys are generated and stored inside AWS SES. You publish only public CNAME pointers.

Could this be abused to spoof our domain?

The opposite. DKIM/SPF/DMARC are anti-spoofing controls — only AWS-SES-signed mail from the subdomain validates.

Can OneLens read our incoming email?

No. The MX record is on the bounce subdomain and carries delivery-status notifications only. Your mailboxes and inbound mail are unaffected.

Will this break our existing SPF or email?

No. All records live on a separate subdomain, so your primary domain's SPF/DMARC and existing mail stay exactly as they are.

How do we revoke it?

Delete the DNS records. Branded sending via your domain stops immediately.

Need Help?

Reach out to your OneLens contact or email [e-mail] — we'll generate your exact DNS records and verify the setup with you.