> ## Documentation Index
> Fetch the complete documentation index at: https://docs.maski.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Custom domains

> Use your own domain for aliases. Add the domain, publish the DNS records, and Maski verifies and activates it.

A custom domain lets you receive alias mail on a domain you own, for example
`hello@yourcompany.com`, instead of a shared Maski domain. You control the whole
namespace, so any local part is available and reserved-name restrictions do not
apply.

<Info>
  Custom domains are a Pro feature. Pro includes 3 custom domains. You also unlock
  [send-from-alias](/send-from-alias) on a verified custom domain.
</Info>

## Adding a domain

<Steps>
  <Step title="Claim the domain">
    Add your domain in the dashboard under Domains. Maski gives you an ownership
    token and the records to publish.
  </Step>

  <Step title="Publish the DNS records">
    Add the records below at your DNS provider. See the table for exact names and
    values.
  </Step>

  <Step title="Verify">
    Maski checks your DNS automatically every few minutes, or press Verify now to
    check immediately. A claim expires if it is not verified within 72 hours.
  </Step>
</Steps>

## DNS records

Publish these at your DNS host. Replace `<domain>` with your domain and `<region>`
with the SES region shown in the dashboard. Maski shows the exact generated values,
including your DKIM tokens, alongside each record.

| Purpose                | Type  | Host                          | Value                                  | Priority |
| ---------------------- | ----- | ----------------------------- | -------------------------------------- | -------- |
| Ownership              | TXT   | `_maski-verify.<domain>`      | `maski-verify=<ownership-token>`       | —        |
| Inbound mail           | MX    | `<domain>`                    | `<mx-target>`                          | 10       |
| DKIM signing (up to 3) | CNAME | `<token>._domainkey.<domain>` | `<token>.dkim.amazonses.com`           | —        |
| Bounce routing         | MX    | `bounces.<domain>`            | `feedback-smtp.<region>.amazonses.com` | 10       |
| Bounce SPF             | TXT   | `bounces.<domain>`            | `v=spf1 include:amazonses.com ~all`    | —        |
| DMARC (recommended)    | TXT   | `_dmarc.<domain>`             | `v=DMARC1; p=none;`                    | —        |

<Note>
  DKIM records are issued only after ownership is verified, so you publish the
  ownership TXT record first, then the DKIM records once they appear. DMARC is
  advisory and never blocks activation.
</Note>

## Activation

A domain becomes active only when every required record is in place and mail
signing is fully set up, both DKIM and the bounce sender domain. There is no
partial activation. This is what guarantees Maski never forwards mail that is not
properly signed and aligned.

## Catch-all

A verified custom domain can run a catch-all, so any address on the domain that is
not a specific alias still receives mail. Replies and forwards use the real
recipient name that was addressed, not a literal wildcard.

## Downgrading

If you move from Pro back to free, your custom domains are disabled and mail on
them stops. Your aliases and data stay in place. If you upgrade again and the DNS
records are still published, the domains re-verify automatically.