Set Up Your Invoice Email Domain

This guide walks through the guided setup in Keito, from entering the sender to publishing the DNS records. Check the requirements first: you need the Business plan, the Owner or Administrator role, and access to your domain’s DNS.

The examples use the From address billing@acme.example, so the domain being set up is acme.example. Replace it with your own domain.

Open the email sender settings

  1. Go to Invoices > Configure > Messages.
  2. Find the Email sender card, below Client-facing email.
  3. Select Your domain.

The guided setup has five steps, shown at the top: Sender, Ownership, Records, Verify, and Ready. You can close the page at any point. Keito keeps checking in the background, and the setup reopens at the right step next time. Close setup for now collapses the setup into a card with a Continue setup button.

Step 1: Enter the sender

Fill in three fields:

Field What to enter
Sender name for your domain The name clients see, for example Acme Billing. It starts with your saved sender display name. It can’t contain an email address.
From address on your domain The address invoices come from, for example billing@acme.example.
Reply-To for your domain (optional) Where replies go, for example accounts@acme.example. It starts with your saved Reply-to email, and it can be on any public domain, such as your accountant’s. If you leave it blank, replies go to the Reply-to email under Client-facing email, or to the person who sends the invoice when that is blank too.

Below the fields Keito shows the exact domain it will authenticate, for example “We will authenticate acme.example”. Keito authenticates the exact domain after the @:

  • billing@acme.example authenticates acme.example.
  • invoices@billing.acme.example authenticates the subdomain billing.acme.example, and all of its records go under that subdomain. See subdomain or main domain.

Select Start setup.

If Keito refuses the address, the message explains why. The most common reasons are a shared mailbox domain such as gmail.com, a domain that another Keito workspace is already setting up or using, a setup already in progress for your workspace, or the setup limit.

Step 2: Prove ownership

Keito shows one TXT record. It proves that you control the domain, and nothing is created with the email provider until Keito finds it.

Type Host Value TTL
TXT _keito-verification.acme.example keito-domain-verification=<value shown in Keito> 300 seconds
  1. Use the Copy buttons to copy the host and the value exactly.
  2. Add the record at your DNS provider. See Add the DNS records at your provider for provider steps and how to enter the host.
  3. Return to Keito. It checks for the record every minute for the first 10 minutes, then every 5 minutes for the rest of the first hour, then every 30 minutes. Select Check DNS to check straight away.

The value is shown in full right after you start the setup. After you leave the page it appears as “Hidden”, because Keito never stores it in plain text. Select Show value again to display it.

Regenerate record issues a new value and invalidates the old one. A TXT record that still holds the old value is reported as Different value found. Use it only if the value was lost or you think it was exposed. The host stays the same, and regenerating restarts the seven days before the setup expires. Regenerate is available only until ownership is confirmed.

Keep this TXT record published for as long as you send from the domain. Keito checks it again during regular health checks, and removing it pauses sending.

Step 3: Add the authentication records

When the ownership record is found, Keito asks the email provider for your DKIM keys. “Waiting for the email provider to issue your DKIM records” usually lasts under a minute. Then Keito shows all four records:

Type Host Value TTL
TXT _keito-verification.acme.example keito-domain-verification=<value shown in Keito> 300 seconds
CNAME <token-1>._domainkey.acme.example <token-1>.dkim.amazonses.com 1800 seconds
CNAME <token-2>._domainkey.acme.example <token-2>.dkim.amazonses.com 1800 seconds
CNAME <token-3>._domainkey.acme.example <token-3>.dkim.amazonses.com 1800 seconds

Each <token> is a long random string that Keito shows in full. The three CNAME records point your domain’s DKIM selectors at the email provider’s signing keys. Publish all three, and keep the TXT record from step 2.

  • Host: Keito shows the full host name. Many DNS providers add your domain to the host automatically, so you enter only the part before your domain, such as <token-1>._domainkey. If the record would end up as acme.example.acme.example, the domain was added twice.
  • Value: enter the CNAME target exactly as shown.
  • TTL: the TTL shown is a suggestion. Your provider’s default is fine.
  • Proxy: CNAME records must not be proxied or flattened. At Cloudflare, set Proxy status to DNS only.

The records live on their own host names, so they don’t touch your existing MX, SPF, or DMARC records.

Send the records to whoever manages your DNS

Download setup sheet (.md) and Download setup sheet (.txt) save the records, the DMARC advisory, and entry notes as a file. The sheet contains DNS requirements only, with no invoice, client, or account data. The ownership value is included only after you select Show value again; otherwise the sheet says where to find it in Keito. Share the sheet only with the person who will add the records.

When the records are published, select Continue to verification.

Step 4: Verify

The Verify step shows three checks that must all pass:

Check What it means
Ownership proof The TXT record holds the current value.
DKIM readiness All three CNAME records point at the right targets, and the email provider has verified signing.
Provider sending readiness The email provider reports the domain verified and sending enabled.

Seeing the records in DNS isn’t enough on its own. The email provider runs its own check, which can take a few minutes after the records are visible. The step also shows the status of each record and a DMARC advisory.

When all three checks pass, the setup moves to Ready.

Step 5: Ready

The last step shows exactly how your emails will be sent, for example from "Acme Billing" <billing@acme.example> with replies to accounts@acme.example. You can send a test email before you activate.

Continue with Verify, test, and activate.

If the setup stops

  • A record shows Not found or Points elsewhere: see Troubleshooting.
  • Needs attention with a reference: the problem is on the email provider’s side and there is nothing to change in your DNS. Contact support and quote the reference. After support confirms the fix, Check DNS retries the step.
  • Expired: a setup that isn’t verified within seven days expires. Select Start a new setup. A new setup counts toward the setup limit.