Add and verify Mailtrap sending domains with DNS records

This skill covers adding and verifying a Mailtrap sending domain, required before any live email can go out. Mailtrap's UI or API shows the complete set of DNS records a domain needs - all of them must be added, never cherry-picked - and the hostname added must be the exact one used in the From address: if sending from notifications.mycompany.com, that subdomain is the sending domain, not just the root mycompany.com, unless mail is genuinely sent from the root.

Use it for new Sending Domains setup, stuck verification, compliance questions, or DNS configuration at Cloudflare, AWS Route 53, Google Cloud DNS, Squarespace, GoDaddy, Namecheap, or DigitalOcean. It does not apply to sandbox-only testing without a custom domain, which is covered by mailtrap-testing-with-sandbox instead; this skill is the prerequisite step before mailtrap-sending-emails can actually deliver mail.

For scripted or AI-assisted automation, the preferred path is entirely API-driven: GET /sending_domains lists domains, GET /sending_domains/{id} returns each dns_records entry (type, name, value, verification status) plus an overall dns_verified flag to poll after publishing; POST /sending_domains with a domain_name creates a domain programmatically; and the returned records get published at the DNS host via its own API (Cloudflare API, Route 53, Google Cloud DNS) or infrastructure-as-code, matching names and values exactly. All calls need Authorization: Bearer $MAILTRAP_API_TOKEN and an $MAILTRAP_ACCOUNT_ID resolved from GET /api/accounts. The manual fallback is Sending Domains > Add domain > copy each record into the registrar's UI > Verify, using dig/nslookup to confirm a record is publicly visible before re-clicking Verify if it stays pending.

GET /api/accounts/$MAILTRAP_ACCOUNT_ID/sending_domains/{id}
  -> dns_records: [{type, name, value, status}], dns_verified

Mailtrap publishes click-path DNS guides for each major provider, to be followed alongside the live record values shown in the UI or API - for unlisted providers, the same rule applies: copy every record into whichever DNS zone serves the From domain. A critical, easy-to-miss caveat: if the DNS provider proxies records (Cloudflare's orange-cloud mode, or similar CDN/proxy modes elsewhere), verification records must stay DNS-only/non-proxied unless Mailtrap explicitly allows proxying, since a proxied CNAME silently breaks SPF/DKIM verification.

Developers and operators setting up or debugging Mailtrap domain verification before enabling live sending, whether automating the whole flow via the Sending Domains API and their DNS provider's API, or walking through the manual UI-plus-registrar path - and anyone whose verification is stuck should check first whether their DNS records are accidentally being proxied.