> For the complete documentation index, see [llms.txt](https://docs.onelens.cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.onelens.cloud/solutions/white-labeling-custom-email-domain.md).

# White Labeling - Custom Email Domain

**TL;DR**

* **What:** OneLens sends product email (reports, alerts, invites) from *your* brand — `noreply@mail.yourdomain.com` instead of `onelens-mail.com`.
* **Setup:** DNS-only. You publish \~5 records on a **dedicated mail subdomain**; nothing to install, no servers, no keys shared.
* **Scope:** Limited to `mail.yourdomain.com`. Your root domain, website, and existing corporate email are never touched.

## What You'll Get Once Connected

| Capability           | What it means for you                                                                        |
| -------------------- | -------------------------------------------------------------------------------------------- |
| Branded sender       | Emails arrive from `noreply@mail.yourdomain.com` with your name — no "via onelens-mail.com". |
| Inbox deliverability | Full SPF + DKIM + DMARC authentication, so mail lands in the inbox, not spam.                |
| Anti-spoofing        | The same records make it *harder* for anyone to impersonate your domain.                     |
| Zero maintenance     | Signing keys are held and auto-rotated by AWS — set once, nothing to renew.                  |

## Security at a Glance

| Your concern                                    | Answer                                                                |
| ----------------------------------------------- | --------------------------------------------------------------------- |
| Can OneLens send as our root `@yourdomain.com`? | No — only the `mail.yourdomain.com` subdomain.                        |
| Do you need access to our DNS?                  | No — you add the records yourself; we never touch your zone.          |
| Do we share any private keys?                   | No — DKIM keys stay inside AWS; you publish only public pointers.     |
| Can you read our incoming email?                | No — the bounce record handles delivery reports only, not your inbox. |
| Will this change our existing email?            | No — everything is on a separate subdomain.                           |
| Can we revoke it?                               | Yes — delete the records and sending stops immediately.               |

## Cost of the Integration

Included in OneLens — there is no additional charge for branded email.

## How It Works

{% stepper %}
{% step %}

## We generate

OneLens creates a sending identity for your mail subdomain and hands you the exact DNS records.
{% endstep %}

{% step %}

## You publish

Your team adds \~5 records to `mail.yourdomain.com` in your DNS.
{% endstep %}

{% step %}

## We verify & send

Once the records are live, OneLens verifies the domain and starts sending your branded email. Bounces and complaints are monitored automatically.
{% endstep %}
{% endstepper %}

## Prerequisites

* A domain you control (e.g. `yourdomain.com`) and access to add DNS records.
* Agreement to use a **mail subdomain** — `mail.yourdomain.com` — as the sending identity.
* An active OneLens account; branded email enabled by your OneLens contact.

## What OneLens Will Access

* Permission to **cryptographically sign** email for `mail.yourdomain.com` (DKIM).
* Delivery-status (bounce/complaint) notifications for that subdomain.

## What OneLens Will NOT Access

* Your **root domain** or any other subdomain.
* Your **DNS zone** — you publish records yourself; this is **not** domain/NS delegation.
* Your **inbound email** or mailboxes — the bounce record is for delivery reports only.
* Any **private keys or secrets** — DKIM keys are generated and held by AWS SES.

## Set It Up — DNS Records

Add these records to `mail.yourdomain.com` (OneLens gives you the exact CNAME values at onboarding):

| #   | Type  | Host / Name                              | Value                                               | Purpose                      |
| --- | ----- | ---------------------------------------- | --------------------------------------------------- | ---------------------------- |
| 1–3 | CNAME | `<token>._domainkey.mail.yourdomain.com` | `<token>.dkim.amazonses.com`                        | DKIM signing (3 records)     |
| 4   | MX    | `bounce.mail.yourdomain.com`             | `10 feedback-smtp.ap-south-1.amazonses.com`         | Bounce / return-path routing |
| 5   | TXT   | `bounce.mail.yourdomain.com`             | `v=spf1 include:amazonses.com ~all`                 | SPF authorization            |
| 6   | TXT   | `_dmarc.mail.yourdomain.com`             | `v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com` | DMARC policy (recommended)   |

{% hint style="warning" %}
**Add all of them.** DKIM alone verifies the domain but leaves SPF unaligned — mail can still land in spam (Outlook especially). The MX + SPF (records 4–5) are what align SPF to your domain and drop the "via" label.
{% endhint %}

## Verify It Worked

After the records propagate, OneLens confirms the domain shows **DKIM verified**, **MAIL-FROM verified**. On the receiving side, open any OneLens email → "Show original" and confirm:

* `spf=pass` (aligned to `mail.yourdomain.com`)
* `dkim=pass`
* `dmarc=pass`
* No "via onelens-mail.com" in the sender line.

## Rotation & Maintenance

Nothing to do. AWS SES rotates the DKIM keys behind the CNAMEs automatically. Leave the records in place; if you ever migrate DNS providers, re-add the same records.

## Data Privacy & Security

* Records are scoped to `mail.yourdomain.com` — your primary domain's mail policy is unchanged.
* No private keys leave AWS; you publish only public CNAME pointers.
* OneLens sends via a production, reputation-managed **AWS SES** account (region: `ap-south-1`, Mumbai).
* The setup is fully reversible — delete the records to stop branded sending.

## Troubleshooting

| Symptom                            | Fix                                                                                                                             |
| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| Domain stuck "pending" in OneLens  | DNS not fully propagated — recheck the DKIM CNAMEs and the MX/SPF on `bounce.mail...`; allow up to a few hours.                 |
| Mail lands in Junk despite records | Confirm `spf/dkim/dmarc = pass` in the raw headers; a brand-new domain also needs a short warm-up period. Mark "Not Junk" once. |
| "via onelens-mail.com" still shows | The custom MAIL-FROM (records 4–5) isn't verified yet — check the MX + SPF on the bounce subdomain.                             |
| Bounces not visible                | Ensure the MX record points to the correct region (`feedback-smtp.ap-south-1.amazonses.com`).                                   |

## FAQ

<details>

<summary>Does this let OneLens send email as our root domain?</summary>

No. Only the `mail.yourdomain.com` subdomain is authorized. Your root domain is untouched.

</details>

<details>

<summary>Are you asking for access to our DNS?</summary>

No. You add \~5 records in your own DNS. OneLens never accesses your zone — this is deliberately not subdomain/NS delegation.

</details>

<details>

<summary>Do we hand over any private keys or secrets?</summary>

No. DKIM keys are generated and stored inside AWS SES. You publish only public CNAME pointers.

</details>

<details>

<summary>Could this be abused to spoof our domain?</summary>

The opposite. DKIM/SPF/DMARC are anti-spoofing controls — only AWS-SES-signed mail from the subdomain validates.

</details>

<details>

<summary>Can OneLens read our incoming email?</summary>

No. The MX record is on the bounce subdomain and carries delivery-status notifications only. Your mailboxes and inbound mail are unaffected.

</details>

<details>

<summary>Will this break our existing SPF or email?</summary>

No. All records live on a separate subdomain, so your primary domain's SPF/DMARC and existing mail stay exactly as they are.

</details>

<details>

<summary>How do we revoke it?</summary>

Delete the DNS records. Branded sending via your domain stops immediately.

</details>

## Need Help?

Reach out to your OneLens contact or email <support@onelens.cloud> — we'll generate your exact DNS records and verify the setup with you.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.onelens.cloud/solutions/white-labeling-custom-email-domain.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.