By default, Torii’s emails arrive from hello@toriihq.com. If you verify a domain you own, your organization’s emails arrive from your own address instead, so a person who receives an offboarding task or an access request sees a name and address they already trust.
This is available on Enterprise plans.
Which emails change
Torii sends three types of email, and this setting affects two of them. You can see all three, side by side with the address each currently uses, under Settings > Emails.
| Type of email | Examples | Comes from |
|---|---|---|
| System emails | Password resets, invitations, sign-ups | Always hello@toriihq.com. These never move to your domain, so a person locked out of their account can still tell a real Torii email from a forged one. |
| Organization emails | Tasks, offboarding, access requests, reports | The address you choose, once a domain is verified. |
| Sent on behalf of a user | A workflow email whose From field is set to originate from a user | That person’s own address, if their domain is verified. Otherwise your organization address, and otherwise Torii’s. |
Before you start
- Admin access in Torii, since this lives in Settings.
- Someone who can publish DNS records for the domain. You will add two. If that is a different team, have them on hand before you start: the records are shown once you add the domain, and Torii cannot verify it until they are live.
Add a domain
- Go to Settings > Emails and find Sending domains.
- Select Add domain.
- Enter the full domain, exactly as it appears after the
@in your people’s email addresses. Do not shorten it or leave any part off. See the examples below. - Select Continue.
Which domain to enter
Copy everything after the @ in the addresses you want Torii’s emails to come from: nothing more, nothing less.
| If your people’s addresses look like… | Enter this | Not this |
|---|---|---|
dana@acme.com | acme.com | dana@acme.com, www.acme.com |
dana@mail.acme.com | mail.acme.com | acme.com, which is a different domain |
dana@acme.co.uk | acme.co.uk | acme.com |
Enter the domain on its own: no @, no www., and no https://.
One domain at a time. Verifying a domain covers that domain exactly and does not extend to its subdomains. If your people are spread across several, such as acme.com and acme.co.uk, or acme.com and mail.acme.com, add each one separately.
Publish the DNS records
Torii shows two records as soon as the domain is added. Each has a copy button. Add both at your DNS provider exactly as shown.
TXT: the DKIM key
- Host:
scph0125._domainkey.acme.com - Value:
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GN…
This lets receiving mail servers confirm an email really came from your domain and was not altered on the way. The key is unique to your domain. Do not reuse one from elsewhere, and copy the value whole, including the v=DKIM1; at the front.
CNAME: the bounce record
- Host:
bounce.acme.com - Value:
sparkpostmail.com
This gives undeliverable mail somewhere to come back to, so Torii can tell you an address failed instead of the message vanishing.
Your DKIM selector and key will differ from the example above, so always copy the values Torii shows you rather than typing them out. The host names follow exactly the pattern shown: the DKIM record sits under _domainkey on your domain, and the bounce record under bounce.
Verify the domain
Once both records are published, select Verify. Torii checks the records immediately and tells you what it found.
DNS changes can take a few hours to appear. If Torii does not find the records yet, nothing is wrong. Leave the domain as it is and select Verify again a little later. The dialog shows when it last checked. You can close it and come back; the records stay available behind the eye icon on the domain.
When it succeeds, the domain is marked Verified with the date, and you can choose an address on it.
Choose the address recipients see
Under Send emails from, the Organization emails row gains two fields once you have a verified domain.
From and Reply-To address
Type the part before the @, such as notifications or it, then pick one of your verified domains beside it. The list contains only verified domains, so there is no way to select an address Torii cannot actually send from.
The address saves when you click away from the field; there is no separate save button. To go back to Torii’s address, use Reset to hello@toriihq.com beneath the field.
This is both the address recipients see and the address a reply goes to, so choose a mailbox someone actually reads. A no-reply address will silently swallow replies from people who have questions about an access request.
Display name
The name shown beside the address, IT by default. Recipients see it followed by via Torii, which tells them the message was sent through Torii on your behalf. This field works with or without a verified domain.
Send yourself a test email
On any verified domain, use Send yourself a test email from this domain. It arrives at your own Torii account address, from the domain you just set up.
This is worth doing before you rely on it. Open the message and check the sender reads as you expect, then look at the message details in your mail client (Gmail’s Show original, or the equivalent) and confirm authentication passed for your domain rather than for Torii’s.
Domain statuses
| Status | Meaning | What arrives |
|---|---|---|
| Pending | Added, but the DNS records have not been confirmed yet. | From hello@toriihq.com |
| Verified | The records are in place and Torii can send from this domain. | From your address |
| Failed | The records could not be found, or stopped being found. The reason is shown on the domain. | From hello@toriihq.com |
| Disabled | The domain is not in use for sending. | From hello@toriihq.com |
Email is never blocked. Whenever a domain is anything other than Verified, Torii falls back to hello@toriihq.com and the email still goes out. A DNS change that breaks verification will change how your emails look, but it will not stop them arriving.
What Torii keeps checking
Torii re-checks every verified domain daily. If the DNS records are removed or changed, whether by a provider migration or a records cleanup, the domain moves to Failed and its emails go back to Torii’s address until the records are restored.
So if emails that used to come from your domain suddenly arrive from hello@toriihq.com, check Sending domains first: the DNS records are the usual cause.
Troubleshooting
The domain will not add at all
We could not add acme.com. Please contact support and we will look into it.
The domain is already registered for sending elsewhere, so it cannot be claimed here. This is not something you can resolve from your DNS settings. Contact Torii support with the domain name and we will sort it out. A small number of top-level domains are also unavailable for sending, and support can confirm whether yours is one of them.
Verification says the records were not found
Verification failed: The DNS records could not be found
Almost always one of three things:
- The change has not propagated yet. Wait and select Verify again.
- The host name has your domain appended twice. Many DNS providers add the domain for you, so pasting the full host produces
scph0125._domainkey.acme.com.acme.com. Check what your provider actually saved. - The value was truncated or re-wrapped. The DKIM value is long. Re-copy it with the copy button and paste it as a single unbroken string.
The records are right, but it still will not verify
Our email provider could not confirm this domain yet. Please try again shortly.
Torii found your records but our email provider has not confirmed them on its side yet. Wait a few minutes and select Verify again. If it persists for more than a few hours with the records unchanged, contact support.
Our email provider will not send from this domain. Please contact support and we will look into it.
This one will not clear on its own. Contact Torii support with the domain name.
Remove a domain
Use Remove sending domain on the domain you no longer want. If it was the domain your organization address used, that address is cleared too and organization emails go back to hello@toriihq.com.
You can safely delete the DNS records afterwards. If you re-add the domain later you will be given a new DKIM key and will need to publish the records again. The old ones will not verify.