Use case

Send email without managing SES and DNS

AscendKit runs email on AWS SES and handles the painful setup for you: domain verification, DKIM and SPF, DNS provider detection, and Cloudflare DNS automation. You author a versioned template and send it; the deliverability plumbing every startup defers is already done.

How it works

1. Verify your domain
AscendKit guides domain verification and detects your DNS provider, automating record creation where supported.
2. Author a template
Build a versioned email template with variable placeholders, in both HTML and plain text, in the portal.
3. Send and track
Send from the SDK with SES delivery, then track opens, clicks, and unsubscribes on the user record.

What does domain verification actually involve?

Publishing DNS records that prove you control the domain and authorize a provider to send as you. Three record types matter, and getting any of them wrong means your email silently lands in spam rather than failing loudly.

DKIM signs each message with a private key and publishes the public key in DNS, so receivers can verify the message was not altered and genuinely came from an authorized sender. SPF lists which servers may send for your domain. DMARC tells receivers what to do when DKIM or SPF fails, and — more usefully — where to send reports.

AscendKit generates the records, detects your DNS provider, and automates the Cloudflare path entirely. What it cannot do is skip propagation: DNS changes take time to become visible, and verification is not complete until they are.

The three records and what breaks without each.
Record	Proves	Without it
DKIM	The message was not altered in transit	Messages fail authentication at major providers
SPF	This server is allowed to send for the domain	Higher spam placement, some outright rejection
DMARC	What to do when the other two fail	No visibility, weaker deliverability over time

Why does deliverability get worse as you grow?

Because reputation is earned per domain and per volume, and a sudden increase looks exactly like a compromised account. A domain that sent 50 emails a day and suddenly sends 5,000 will see delivery degrade even with perfect DNS.

The mitigation is warming: increase volume gradually so receivers build a positive reputation for the domain. This matters most on your first campaign, which is where teams usually discover it, and it is why AscendKit separates transactional email from campaigns rather than treating them as one stream.

Suppression is the other half. Addresses that hard-bounce or file spam complaints must stop receiving mail immediately, because continuing to send to them is the fastest way to damage a domain's reputation. AscendKit suppresses these automatically.

Troubleshooting

Verification stays pending after adding the records

Cause: DNS propagation, or the records were added to the wrong zone — a common mistake when the apex and a subdomain are managed separately.

Fix: Confirm the records resolve with dig or an online DNS lookup before assuming a problem. If they do not resolve, check which zone actually serves the domain.

Email lands in spam despite passing DKIM and SPF

Cause: Authentication is necessary but not sufficient. Content and reputation also matter, and a new domain has no reputation at all.

Fix: Keep transactional email short and free of marketing markup, and grow volume gradually. A one-line message with a single button outperforms a designed template for verification and magic-link email.

FAQ

Do I need to configure DKIM and SPF myself?

No. AscendKit handles domain verification, DKIM, and SPF, and can automate the DNS records, including Cloudflare, so you do not hand-edit deliverability settings.

Is email delivery on a shared IP or my own domain?

Email is sent from your verified domain on AWS SES, so it authenticates as you rather than a generic shared sender.

Related guides

AscendKit vs Resend — the dedicated email API, if that is all you need.
Add magic link login — the auth flow most dependent on the deliverability work described here.
Campaigns — bulk sending, where domain reputation matters most.

Start with one API key

Auth, email, surveys, and journeys share one user record, so you ship this without stitching vendors together.

Start free