Create Domain
CLI:
Authentication
Bearer authentication of the form Bearer <token>, where token is your auth token.
Request
The name of the domain (e.g., example.com).
Allow registration when the domain already has Google Workspace MX records.
Defaults to false; registration otherwise returns 422 when a conflicting
provider is detected.
This flag does not configure DNS or inbound routing. For shared Google
Workspace domains, follow the Google Workspace guide.
Only checked when inbound_enabled is true; a send-only domain skips the check.
Receive email for this domain. Defaults to true. Set false for a send-only
domain: the apex MX record is not required and is omitted from records, so the
domain's existing email provider keeps receiving its mail. Inboxes on a send-only
domain can still send.
Allow inboxes on any subdomain of this domain. Adds a required wildcard MX
record (*.<domain>) to records.
Serve open tracking pixels from this domain. Adds a required link.<domain>
CNAME record to records, which must be published and verified before
track_opens can be used on a send.
Response
The name of the domain (e.g., example.com).
Allow inboxes on any subdomain of this domain. Adds a required wildcard MX
record (*.<domain>) to records.
Serve open tracking pixels from this domain. Adds a required link.<domain>
CNAME record to records, which must be published and verified before
track_opens can be used on a send.
A list of DNS records required to verify the domain. Includes the apex
MX record unless inbound_enabled is false, and a wildcard MX record
(*.<domain>) when subdomains_enabled is true.
Why the domain is not (yet) VERIFIED, when known. dns_records_missing / dns_records_invalid point at the DNS records. The ses_* values mean the records look right and sending-infrastructure validation has not converged: ses_dkim_pending / ses_mail_from_pending (still checking), ses_dkim_temporary_failure / ses_mail_from_temporary_failure (a transient error the infrastructure keeps retrying on its own — usually resolves without changes), ses_dkim_failed / ses_mail_from_failed (a terminal verdict; re-verify after fixing), ses_dkim_not_started / ses_mail_from_not_started (the attribute was never configured on the identity — re-verify to push it), and ses_not_verified_for_sending. Absent when VERIFIED.
Absent on domains created before this field existed; those receive email.
