Authorize a MailChannels domain with Domain Lockdown

The current MailChannels Email API requires account/API authentication and sender authorization. Do not start from an obsolete example that assumes an arbitrary Worker can send anonymously through a free relay.

Configure the sending identity

1. Create/select the intended account and generate an API key with the documented api scope.
2. Publish a Domain Lockdown TXT record authorizing that account for each sending domain.
3. Configure SPF, DKIM, and DMARC according to the current domain instructions. Merge SPF requirements rather than adding a second SPF record.
4. Confirm the sender domain resolves and keep the API key in backend secret configuration.

The Node.js quickstart documents the _mailchannels authorization record and current prerequisites. Its sample account identifier is not a value to copy into your own DNS.

Verify the account restrictions too

Use a controlled recipient permitted by the account’s current onboarding/billing restrictions. A verified domain does not remove all recipient or account restrictions.

Check the resulting message activity and domain authorization errors before changing code. Do not weaken domain ownership controls or reuse another tenant’s authorized sender to get a test through.

For multi-tenant applications, keep sender/domain ownership associated with the correct tenant; protect the rest of the platform if one sender is restricted. MailKite uses a separate domain-verification and API-key contract, not a shared Domain Lockdown authorization.