URL: /code/apps/mailboxes/authenticate · Id: `page:/code/apps/mailboxes/authenticate`

# Domain.authenticate

> Writes your domain’s SPF, DKIM and DMARC records and checks them before its first send.

POST https://api.sb/{your-domain}/domains/{domain}/authenticate

Writes your domain’s SPF, DKIM and DMARC records and checks them before its first send.

- **Action class:** None
- **Approval:** Runs on its own
- **Emits:** `Domain.authenticated`
- **Price:** Free

```text title="Run it · Ask"
Set up SPF, DKIM and DMARC on tryleaseline.app before the first send.
```

```ts title="Run it · SDK"
import { $ } from 'startup-builder'

const result = await $.try.Domain.authenticate({ domain: 'https://api.sb/leaseline.app/domains/domain_Tl5rY2aP8p', dmarc: 'p=none; rua=mailto:dmarc@leaseline.app' })
```

```json title="Run it · Response"
{
  "api": "https://api.sb/leaseline.app",
  "domain": {
    "$id": "https://api.sb/leaseline.app/domains/domain_Tl5rY2aP8p",
    "$type": "Domain",
    "hostname": "tryleaseline.app",
    "spf": "pass",
    "dkim": "pass",
    "dmarc": "pass"
  },
  "action": {
    "operation": "Domain.authenticate",
    "mode": "try",
    "status": "done"
  }
}
```

Its Inputs, Outputs, Effects and guards quote [the hub’s `Domain.authenticate`](https://startupbuilder.dev/business/nouns/domain/authenticate); this page adds what each Venue honors, its limits and a worked call. It is one of the [Verbs](https://startupbuilder.dev/business/nouns/verb) of [Mailboxes](/code/apps/mailboxes#verbs).

## Inputs
| Name | Type | Meaning |
| --- | --- | --- |
| `domain` | `Domain` | Required. The sending Domain. |
| `dmarc` | `string` | The DMARC policy; it starts at `none` with reports and tightens to `quarantine`. Optional. |

## Outputs
| Field | Type | What `null` means |
| --- | --- | --- |
| `domain` | `Domain` | Never null: the Domain, authenticated. |

## Effects
**Action class**

None: no approval rule names it, so it runs within its seat’s Permissions and Limits

**Modes**

- `try`: Runs every check and returns the record as it would be; nothing is stored.
- `send`: Returns a pending Action at once; `Domain.authenticated` fires when it is done.
- `do`: Waits for the Action to finish and returns the record.

**Idempotency**

Only with a key: the same `Idempotency-Key` and input return the first Action, and the same key with other input returns `409`.

**Saved or shared**

Refuses every send from the Domain until all three records verify. Cold outbound sends only from secondary Domains, never the Domain receipts use.

**Emits**

`Domain.authenticated` with `{ domain }`

**Performed by**

[Security Engineer](https://startupbuilder.dev/agents/engineering/security-engineer)

**Price**

Free on your own account: the platform charges nothing for the call.

## On each Venue
It acts on your own records and reaches no Venue, so every account answers the same way.

## What try does
Runs every check the call meets and returns the record as it would be; nothing is stored, sent or posted.

## Refuses when
The hub sets no guard of its own on this call: it refuses only on the shared checks every write meets (a missing record, a Permission the seat lacks).

## When it waits
Returns in one response; nothing waits.

## Example
In `send` mode the call returns its pending Action at once, and `Domain.authenticated` delivers the result.

**Ask**

```text
Set up SPF, DKIM and DMARC on tryleaseline.app before the first send.
```

**API**

```bash
curl -X POST "https://api.sb/leaseline.app/domains/domain_Tl5rY2aP8p/authenticate?mode=send" \
  -H "Authorization: Bearer $SB_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "dmarc": "p=none; rua=mailto:dmarc@leaseline.app"
}'
```

**CLI**

```bash
npx startup-builder do Domain.authenticate --send --data '{
  "dmarc": "p=none; rua=mailto:dmarc@leaseline.app"
}'
```

`--send` returns the pending Action at once.

**MCP**

```json
{
  "name": "do",
  "arguments": {
    "mode": "send",
    "code": "return await $.Domain.authenticate({ dmarc: 'p=none; rua=mailto:dmarc@leaseline.app' })"
  }
}
```

**SDK**

```ts
import { $ } from 'startup-builder'

const result = await $.send.Domain.authenticate({
  domain: 'https://api.sb/leaseline.app/domains/domain_Tl5rY2aP8p',
  dmarc: 'p=none; rua=mailto:dmarc@leaseline.app',
})
```


```json title="Response, in send mode"
{
  "mode": "send",
  "action": {
    "$id": "https://api.sb/leaseline.app/actions/action_Sd3kQ9vT2w",
    "operation": "Domain.authenticate",
    "status": "pending",
    "reason": "running"
  }
}
```

To retry, send the same `Idempotency-Key`: the retry returns the first answer for $0. A new key reads again.

## Used by
- **Jobs:** [Reach out](/capabilities/reach-out)

## Related
[`Message.broadcast`](/code/apps/mailboxes/broadcast) · [`Message.schedule`](/code/apps/mailboxes/schedule) · [`Mailbox.warm`](/code/apps/mailboxes/warm) · [`Mailbox.rest`](/code/apps/mailboxes/rest) · [`Mailbox.retire`](/code/apps/mailboxes/retire) · [`Contact.suppress`](/code/apps/mailboxes/suppress) · [`Contact.unsubscribe`](/code/apps/mailboxes/unsubscribe) · [`Consent.withdraw`](/code/apps/mailboxes/withdraw)