---
title: "Verify domain ownership"
method: POST
path: "/domains/{id}/verify"
tags: ["Domains"]
---

# Verify domain ownership

`POST /domains/{id}/verify`

Checks DNS records required for inbound routing, ownership,
and outbound authentication: MX, ownership TXT, SPF, DKIM,
DMARC, and TLS-RPT.
On success, the domain is promoted from unverified to verified.
On failure, returns which checks passed and which failed,
plus the exact DNS records still expected. To give users
an importable DNS file for missing records, call
`downloadDomainZoneFile` or run
`primitive domains zone-file --id <domain-id>`.

## Headers

- `Idempotency-Key` string

## Response `200`

Verification result

- object
  - `success` true, required
  - `data` union, required
    - object
      - `verified` true, required
      - `dns_records` object[] — Exact DNS records to publish for a pending domain claim or verification attempt.
        - `type` 'MX' | 'TXT', required — DNS record type.
        - `name` string, required — DNS-provider host/name value relative to the managed root zone.
        - `fqdn` string, required — Fully-qualified DNS record name.
        - `value` string, required — Exact value to publish.
        - `priority` integer — MX priority. Present only for MX records.
        - `ttl` integer — Suggested TTL in seconds when the API can provide one.
        - `required` true, required
        - `purpose` 'inbound_mx' | 'ownership_verification' | 'spf' | 'dkim' | 'dmarc' | 'tls_reporting', required
        - `status` 'pending' | 'found' | 'missing' | 'incorrect', required
        - `message` string — Short explanation of why this record is needed.
    - object
      - `verified` false, required
      - `mxFound` boolean, required — Whether MX records point to Primitive
      - `txtFound` boolean, required — Whether the TXT verification record was found
      - `spfFound` boolean — Whether the SPF record includes Primitive.
      - `dkimFound` boolean — Whether the DKIM public key record was found.
      - `dmarcFound` boolean — Whether the DMARC record was found.
      - `tlsRptFound` boolean — Whether the TLS-RPT record was found.
      - `dns_records` object[] — Exact DNS records to publish for a pending domain claim or verification attempt.
        - `type` 'MX' | 'TXT', required — DNS record type.
        - `name` string, required — DNS-provider host/name value relative to the managed root zone.
        - `fqdn` string, required — Fully-qualified DNS record name.
        - `value` string, required — Exact value to publish.
        - `priority` integer — MX priority. Present only for MX records.
        - `ttl` integer — Suggested TTL in seconds when the API can provide one.
        - `required` true, required
        - `purpose` 'inbound_mx' | 'ownership_verification' | 'spf' | 'dkim' | 'dmarc' | 'tls_reporting', required
        - `status` 'pending' | 'found' | 'missing' | 'incorrect', required
        - `message` string — Short explanation of why this record is needed.
      - `error` string, required — Human-readable verification failure reason

## Other responses

- `400` — Invalid request parameters
- `401` — Invalid or missing API key
- `404` — Resource not found

---

[API](https://skmtc.net/primitive/apis/primitive-api.md) · [All operations](https://skmtc.net/primitive/apis/primitive-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/primitive/primitive-api/versions/c2299d28022c/schema)