# TrackMailer — Documentation

Last reviewed: 27 August 2026

[HTML](https://docs.markengroup.cloud/trackmailer)

Prepare verified sender domains and separate sending subdomains within your organization. AWS SES delivery is the next activation step, not an already available sending service.

## Account, organization and project

Start at app.markengroup.cloud/register. Enter only your email address and confirm the email link before choosing a password. Then add your name and create an organization; logo and company website are optional.

A person has one account and can belong to several organizations. Create or select a project in the intended organization before using a product. Team invitations are email-bound, expire after seven days and are currently shared as links, not sent automatically by email.

## Access and credentials

The dashboard uses Firebase Authentication. Server operations require a verified email address, active membership and the relevant project/product permission. Reading a project does not automatically grant editing rights.

Use the dashboard for the setup operations described here. Firebase callable functions are internal dashboard interfaces, not a released public REST API. Never embed AWS credentials, server tokens or private keys in websites, browser bundles or public examples.

## What is available?

The implementation includes organization-scoped sender-domain drafts, DNS ownership records and an AWS SES integration that is disabled until a separate account, region and role are configured. Creating a draft does not enable email delivery.

Public API keys, message sending, campaigns, contacts, templates, automations, suppression handling and delivery webhooks are not released. Do not call /v1/campaigns or infer a send endpoint from this guide.

## Add a domain or sending subdomain

In your TrackMailer project, add an exact hostname such as news.example.com. Enter a hostname, not a URL, email address or wildcard. Each sending subdomain is registered separately and receives its own senderDomainId and ownership proof.

Copy the TXT record shown by the dashboard into the authoritative DNS zone. Its full name is _trackmailer.<sender-domain>; use the exact generated value. Some DNS editors append the zone automatically, so enter only the relative name when required. A parent domain's verification is not a substitute for this project's proof.

## Verify DNS and AWS SES

AWS must first be configured by the platform operator. After ownership is confirmed, the integration creates an isolated SES identity and provides three DKIM CNAME records plus MX and SPF records for mkc-bounce.<sender-domain>. Never invent DKIM values: copy the records returned for this identity.

Keep DKIM records DNS-only, without HTTP proxying. Add the return-path MX and SPF only to the specified mkc-bounce subdomain; do not replace your existing root-domain mail records. Leave existing DMARC policies intact and review mail policy changes with your administrator.

Choose Check verification after DNS propagation. Verification requires matching ownership and DNS records plus successful SES identity, DKIM and MAIL FROM status. Conflicts, missing records and resolver errors are not success. Checks have a 30-second cooldown; DNS propagation can take longer.

## Cloudflare and other DNS providers

For Cloudflare, the dashboard opens the Cloudflare dashboard in a new tab. Select the authoritative zone, add each displayed DNS record and return to verify. The automatic one-confirmation Domain Connect flow is not enabled yet; no Cloudflare API token is required by the current manual flow.

The same records work with other DNS providers. Delegated subdomains may have a different authoritative zone from the parent domain. Do not modify unrelated records or transfer a legacy SES identity into this project.

## Sender selection: proposed contract, not a send API

The dashboard can preview a verified sender using senderDomainId and fromLocalPart. The exact selected domain determines the From address; the local part cannot supply or override a domain. The selected identity must belong to the same organization and project.

The following JSON illustrates selection only. There is no public endpoint to send it to. A verified parent does not make arbitrary child domains selectable. Verification must be recent before a preview succeeds.

```json
{
  "senderDomainId": "<id from your project>",
  "fromLocalPart": "billing"
}
```

## Troubleshooting and safe retries

AWS not configured: the platform operator must complete the isolated AWS setup. Ownership pending: check the exact TXT name and value. DNS conflict: inspect the indicated record without replacing unrelated records. Permission denied: ask an organization administrator for project-specific editing access.

Retry a check after the cooldown and DNS propagation. Never retry by changing credentials or reusing another organization's identity. Do not expose provider error details or secrets when requesting support.

## Products

- [TrackMailer](https://docs.markengroup.cloud/trackmailer.md): Setup preview
- [TrackAny.Click](https://docs.markengroup.cloud/trackany.md): Foundation
- [TrackPost](https://docs.markengroup.cloud/trackpost.md): Coming soon