Bring your own email domain

Connect a domain your business already owns so recipients see mail from an address like sales@yourcompany.com. Setup takes about ten minutes of clicking plus DNS propagation time, which runs in the background. You do this once per domain, in Settings, then Channels, then Email.

Connecting a domain is a two gate process, and both gates are required before you can send:

Prove you own the sending address by clicking a link Brilo emails to it.
Authenticate the domain by adding DNS records that let Brilo sign mail as your domain.

You only need to do this once per domain. After that, adding more sending addresses on the same domain repeats gate one only.

Before you start

A domain your business owns and can edit DNS for, such as yourcompany.com. Public mailboxes at Gmail, Outlook or Yahoo cannot be connected, because nobody can add DNS records to them, so Brilo blocks them up front with a clear message.
Access to that domain’s DNS, or a colleague who has it. If the person setting up Brilo is not the DNS admin, there is a built in path in step 3 to email the records to whoever is.
Admin access to your Brilo workspace.
The Email channel enabled for your workspace. If you do not see Settings, then Channels, then Email, it is not turned on for your workspace yet. Contact support@brilo.ai.
The Pro plan or above. See Plans and what they include.

Your existing email keeps working, untouched. Brilo authenticates your domain on records that cannot collide with your human email: DKIM uses named selectors, and the SPF and MAIL FROM records live on a dedicated send. subdomain with its own MX and SPF. Your apex MX, SPF and DMARC, whether Google Workspace, Microsoft 365 or anything else, are never changed. Brilo also suggests a DMARC record, but only if you do not already publish one. Replies to your agent’s mail land in your normal inbox, see Reply handling.

How it works

Settings > Channels > Email > [ + Add domain ]   opens the setup wizard

 Step 1   Enter domain + from-address      (no mail-provider call yet; public providers blocked)
              |
              v   Brilo emails a single-use link to that exact address (expires in 24h)
 Step 2   Recipient clicks the link  ->  address VERIFIED
              |                          then Brilo creates the domain identity,
              v                          sets a custom MAIL FROM, and generates
                                         the records (DKIM + SPF + DMARC)
 Step 3   Add the records to YOUR DNS, in two groups:
              |     - Domain Verification: 3 DKIM CNAMEs
              |     - Enable Sending:      MX + SPF on send., suggested DMARC
              v     Brilo polls until DKIM verifies (Check now, or auto re-checks)
 Step 4   Domain ACTIVE  ->  send a test email  ->  agents and campaigns can send

 A SEND IS ALLOWED ONLY WHEN:  address status = verified  AND  domain state = active

The two gates are deliberate. The email link step confirms a human controls the mailbox, and the DNS step is the real authentication that lets mail pass DMARC and reach the inbox. Skipping either one would either dead end in spam or let someone claim an address they do not own.

Steps

Add your domain

In your Brilo dashboard, go to Settings, then Channels, then Email. On the Domains and addresses tab, click + Add domain. A setup wizard opens in a panel on the right.Fill in the first step, Add your domain.

Field	What to enter
Domain	The domain you own, such as `yourcompany.com`. Pasting `https://…` or a full email address works too, because Brilo normalises it
From address	The local part before the `@`, such as `sales`. This becomes `sales@yourcompany.com`
Display name (optional)	The name recipients see in the From line, such as `Sales at YourCompany`. Defaults to your workspace name and is editable any time

A live From preview shows exactly what recipients see. When it looks right, click Verify email.

Public email providers are rejected. If you enter gmail.com, outlook.com, yahoo.com, hotmail.com, icloud.com, proton.me or around 50 other consumer providers, the Verify email button stays disabled and you see: “Use a domain your business owns (e.g. yourcompany.com). Public email providers like Gmail, Outlook or Yahoo can’t be connected.” Brilo has to authenticate your domain with DNS records, which is only possible on a domain you control.

Nothing is sent to the mail provider at this step. Brilo only creates the domain record and emails the confirmation link. The domain identity and your DNS records are not created until you complete step 2, so an unconfirmed address never touches the mail provider.

Confirm you own the address

Brilo emails a single use confirmation link to the exact address you entered, with the subject “Confirm your sending address”. The wizard moves to Verify the address and shows “We emailed a verification link to sales@yourcompany.com. Click it to confirm you own this address.”

Open the inbox for that address and find the Brilo email.
Click Confirm address.
You land on a confirmation page that reads “Address confirmed”. Click Continue setup to return to the wizard.

The wizard updates on its own, re-checking every few seconds, so once you confirm it advances to the DNS step without you refreshing. The Resend email button sends a fresh link, and I’ll finish later closes the wizard while saving your progress.

The confirmation link expires in 24 hours. If it lapses, the verify page shows “Link expired”. Reopen the wizard and use Resend email to get a new one.

To prevent abuse, confirmation emails are rate limited per workspace: 3 per hour and 10 per day. If you hit the limit, Brilo asks you to try again later.

Add the DNS records

Confirming the address triggers Brilo to create the domain’s sending identity, set up a custom MAIL FROM subdomain (send.yourcompany.com) for SPF, and generate the full DNS record set. The wizard’s Add DNS records step lists them in two groups that mirror what each record does.Domain Verification (DKIM). Three CNAME records that let Brilo sign mail as your domain.

Type	Host	Value	TTL	Priority
CNAME	`<token1>._domainkey`	`<token1>.dkim.amazonses.com`	Auto	none
CNAME	`<token2>._domainkey`	`<token2>.dkim.amazonses.com`	Auto	none
CNAME	`<token3>._domainkey`	`<token3>.dkim.amazonses.com`	Auto	none

Enable Sending (SPF and DMARC). SPF is an MX and TXT on the dedicated send. subdomain, so SPF authenticates your domain without touching your apex SPF.

Type	Host	Value	TTL	Priority
MX	`send`	`feedback-smtp.<region>.amazonses.com`	Auto	10
TXT	`send`	`v=spf1 include:amazonses.com ~all`	Auto	none

DMARC is optional, and suggested only if you do not already publish a policy.

Type	Host	Value	TTL	Priority
TXT	`_dmarc`	`v=DMARC1; p=none;`	Auto	none

Add every record at your DNS provider, whether Cloudflare, GoDaddy, Route 53 or another, with the exact Host and Value shown. The Host column is already relative to your domain (send, _dmarc, <token>._domainkey), which is what most providers expect.

Why SPF and DMARC, not only DKIM? DKIM alone technically passes DMARC, but mailbox providers, Microsoft and Outlook especially, increasingly distrust a brand new domain that publishes no SPF and no DMARC, and route it to spam or quarantine. Adding the send. MAIL FROM for SPF plus a DMARC record is what gets a cold domain into the inbox.

SPF and DMARC do not block activation. Your domain goes Active as soon as DKIM verifies, so you can send right away. The SPF (MAIL FROM) and DMARC records verify in the background and improve deliverability. A missing or slow propagating MAIL FROM safely falls back to the default sender rather than stopping mail.

The wizard gives you a few ways to get the records where they need to go:

Copy all records copies all three at once.
Per-record copy puts a copy button on each Name and Value.
Copy link copies a shareable link that reopens this exact DNS step, so you can hand it to a teammate.
“Not the person who manages DNS?” takes your DNS admin’s email and a click of Send. Brilo emails them the same grouped record tables, plain English instructions, and a link back to this step. No secrets travel in that email, because DKIM, SPF and DMARC records are all public.

After the records are in, Brilo verifies them automatically. The wizard shows “Checking automatically… DNS can take a few minutes · last checked …”, and Check now polls immediately instead of waiting. When DKIM verifies, the domain flips to Active, and the workspace owner gets a “your domain is verified and ready to send” email.

Do not double up the domain in the Host. Many DNS providers automatically append your domain to whatever you type. The Host values shown are already relative (send, _dmarc, <token>._domainkey), so enter them as they are. Adding .yourcompany.com yourself produces send.yourcompany.com.yourcompany.com. When in doubt, check the provider’s preview of the final record name.

These records are purely additive. DKIM uses named selectors, the MX and SPF sit on the dedicated send. subdomain, and DMARC goes on _dmarc only when you do not already have one. None of them touch your apex MX, SPF or your existing DMARC, so human email on the domain is unaffected.

Send a test and finish

Once DKIM verifies, the wizard reaches All set, which reads “Your domain is verified and ready to send.”Before you close it, click Send test email. Brilo sends a real message from your newly verified address to the workspace owner, so you can confirm end to end that it sends, passes authentication and renders correctly. Check the owner’s inbox and the spam folder, then click Done.

Sandbox caveat on the test email. If your mail account is still in sandbox mode, the test send only reaches verified recipients and you see a message saying so. That is an account level provider setting, not a problem with your domain. Production access removes it.

You will know it worked when

The domain shows as Active on the Domains and addresses tab.
The test email arrives in the workspace owner’s inbox, from your own address.
An agent or a campaign can select that address as its sender.

Adding more sending addresses

A verified domain can host several addresses, such as sales@, support@ and ai@. To add another, open the domain in Settings, then Channels, then Email, and click + Add address. Because the domain is already authenticated, you skip the DNS step and repeat the email confirmation gate from step 2 for the new address only. Each address is verified independently. If your company runs more than one Brilo workspace, for example a separate workspace per country or brand, you do not have to re-authenticate the same domain in each one. A domain is verified once by the workspace that sets it up, the owner. Other workspaces can then request to share it, and because the domain is already authenticated, a shared workspace skips the DNS step entirely. It only confirms a sending address.

Sharing is owner approved by design. Proving you control a mailbox on the domain is not enough on its own: the workspace that originally set the domain up has to approve each request. That stops a domain one team set up from being used by another workspace without their knowledge.

Workspace B enters a domain another workspace already verified
      |
      v   Brilo: "already verified by another workspace"  ->  [ Request access ]
 Step 1   B enters the from-address it wants (e.g. sales@) and requests access
      |
      v   Brilo emails the OWNER of the workspace that set up the domain,
 Step 2   naming who is asking and from which workspace.   Approve / Deny.
      |
      v   On Approve: Brilo adds the domain to workspace B already ACTIVE
 Step 3   (no DNS needed) and emails B's sending address a confirmation link.
      |
      v
 Step 4   B confirms the sending address (same email-link gate), tests, sends.

 STILL TRUE FOR THE SHARED WORKSPACE: it can send only once its address is
 verified AND the domain is active. Owner approval alone does not let it send.

Requesting access to a shared domain

In Settings, then Channels, then Email, click + Add domain and enter the domain. If another workspace already owns it, the wizard recognises this and offers Request access instead of showing an error.
Enter the from address you want, such as sales, then click Request access. Brilo emails the owning workspace’s owner to approve. Your domain list shows the request as Requested while you wait.
When the owner approves, the sending address gets the usual confirmation link, and Brilo also emails you that the request was approved and by whom. Click the link to confirm the address. No DNS records are needed, because the domain was already authenticated by its owner.
Send a test email and you are done. If the owner denies the request, the list shows Request denied and you can request again.

Approving a request, as the workspace that owns the domain

If someone asks to share a domain your workspace set up, the workspace owner gets an email reading “‹Name› from ‹their workspace› wants to send email from yourcompany.com.” It links to a page with Approve and Deny.

Approve lets that workspace send from addresses they verify on your domain. Brilo notifies them, and they finish by confirming their address.
Deny rejects the request and lets them know.

Under your domain in Settings, then Channels, then Email, a Shared with line lists the workspaces you have granted. The approval link is single use and expires after 7 days.

Two independent checks protect a shared domain. The owner’s approval is one. The requesting workspace still has to prove it controls a mailbox on the domain, the same email link gate as a first party setup, before it can send. Neither check on its own is enough.

Requirements, rules and conditions

A consolidated reference for everything that governs this flow.

Sending is gated on two conditions

A send only goes out when the address status is verified and the domain state is active. Either one missing blocks the send, and there are no partial states that send.

Public providers are blocked

Domains on a curated list of around 57 free and consumer providers, including Gmail, Outlook, Hotmail, Yahoo, iCloud, Proton, GMX, Zoho, Yandex, QQ, Naver and regional providers such as web.de, orange.fr, libero.it, comcast.net and btinternet.com, are rejected at step 1. Use a domain you own and can add DNS to.

One domain has one owner, and can be shared

A domain is owned by the one workspace that originally authenticated it, meaning the one that added the DNS records. Other workspaces cannot claim it as their own, but they can request to share it: the owner approves by email, and the shared workspace then skips DNS and confirms a sending address. See Sharing a domain across workspaces.

Your existing human mail is never touched

Brilo’s records live where they cannot collide with your human email: DKIM uses named selectors, and the MX and SPF live on a dedicated send.yourcompany.com MAIL FROM subdomain. Your apex MX, SPF and existing DMARC are unchanged. Brilo only suggests a DMARC record at _dmarc when you do not already publish one, and never overwrites an existing policy.

What each record is for

DKIM, three CNAMEs, signs your mail so receivers can verify it came from you.
SPF, an MX and TXT on send., authorises Brilo’s sending host for your domain, aligned to your domain rather than to amazonses.com.
DMARC, an optional _dmarc TXT, publishes a policy so strict receivers, Microsoft and Outlook especially, trust you as an accountable sender.

DKIM alone passes DMARC alignment, so the domain activates on DKIM. SPF and DMARC are not required to send, but a cold domain without them is what gets filtered to spam, so adding all of them is strongly recommended.

Replies go to your existing inbox

Because your domain’s MX still points at your own mail host, a reply to sales@yourcompany.com lands in your normal inbox, not back to the agent. In this version, bringing your own domain is send only, and a human handles replies. Agent handled inbound replies are a separate capability.

Pick a dedicated address, not a person’s

Prefer a purpose address such as sales@, support@ or ai@ over a real employee’s exact address. Sending agent mail as a real person mixes the agent’s replies with their personal mail.

Reputation, root domain against subdomain

Sending from your root domain, such as sales@yourcompany.com, is fine for low volume conversational mail. For higher volume outreach, consider a dedicated subdomain you also own, such as sales@mail.yourcompany.com, to isolate the agent’s sending reputation from your employees’ human email. The setup flow is identical either way.

Limits and timing

Confirmation link: single use, expires in 24 hours.
Confirmation emails: 3 per hour, 10 per day per workspace.
DNS propagation: typically minutes, sometimes a few hours. Verification runs automatically in the background, and Check now forces an immediate poll.

Removing a domain or address

Deleting a domain removes it from Brilo and tears down its sending identity, including the DKIM records on Brilo’s side. Your DNS records become inert and can be deleted at your provider. Deleting a single address leaves the domain verified. Both can be re-added later. If the domain is shared across workspaces, a workspace that was granted access can remove it from its own workspace at any time, and that only drops that workspace’s access. It never affects the owner or any other workspace, and never touches DNS. The owner cannot remove a domain while other workspaces still share it, so the shared workspaces stay protected. Contact support@brilo.ai if you need to fully retire a shared domain.

If it did not work

The Verify email button is disabled, or public providers cannot be connected

You entered a free or consumer email domain such as gmail.com, outlook.com or yahoo.com. Those cannot be authenticated because you do not control their DNS. Use a domain your business owns and can edit DNS for, such as yourcompany.com.

I did not get the confirmation email

Check the spam or junk folder of the exact address you entered.
Confirm you typed the address correctly, because a typo sends the link to the wrong mailbox.
Use Resend email in the wizard. The limit is 3 per hour and 10 per day per workspace.
Links expire after 24 hours, so if it has been longer, resend for a fresh one.

The verify page says "Link expired"

The confirmation link is single use and expires 24 hours after it is sent. Reopen the wizard for that domain and click Resend email to get a new link, then click it within 24 hours.

The domain is stuck on Pending DNS

Brilo has not seen the DKIM records verify yet. Check, in order:

All three CNAME records are added at your DNS provider, for the right domain.
The Name is not doubled up. Some providers auto-append your domain, see the warning in step 3.
Each record’s Value matches exactly (<token>.dkim.amazonses.com), with no trailing dots or extra characters added by the provider.
Give it time, because propagation can take a few hours, then press Check now.

"This domain is already verified by another workspace"

Another Brilo workspace already owns this domain. You do not have to start over: click Request access, and the owning workspace’s owner can approve sharing it with you. Once approved, you skip DNS and confirm your sending address. See Sharing a domain across workspaces. If you do not know who owns it, contact support@brilo.ai.

The test email did not arrive

Check the workspace owner’s spam folder, because the test always goes to the workspace owner rather than to you.
If the owner is on Microsoft or Outlook, also check the organisation level quarantine, not only the Junk folder. Microsoft often quarantines a brand new domain’s first messages there silently. Make sure you added the Enable Sending records, meaning the send. MX and SPF and the _dmarc DMARC, not only DKIM, then send again.
A brand new domain has no sending reputation yet, so the first few messages can be filtered even with perfect authentication. It settles after a small volume of real sends.
If you saw a message about sandbox mode, the account can only send to verified recipients until it has production access. That is a provider side setting, not your domain.
DKIM and SPF may still be propagating. Wait a few minutes and press Send test email again.

The domain shows Action needed

Brilo could no longer verify the domain. Usually the DKIM records were changed or removed at your DNS provider, or the mail provider lost verification. Re-add the three CNAME records exactly as shown and press Check now. If it persists, contact support.

Replies to my agent are not coming back to the agent

That is expected in this version. Your domain’s MX still points at your own mail host, so replies land in your normal inbox and a human handles them. Bringing your own domain is send only for now, and agent handled inbound replies are a separate upcoming capability.

Anything else: My messages are not sending, or email support@brilo.ai with your domain and where you got stuck.

FAQ

Do I need my own domain to send email from Brilo?

No. Your agent sends from a Brilo address out of the box, and campaigns work with no setup at all. Connecting your own domain is for when you want recipients to see your brand and replies to reach your own inbox. See Channels overview.

Which plan do I need to use my own email domain?

Pro or above. Sending from a Brilo address works on lower plans, so this is about branding rather than about being able to send at all. See Plans and what they include.

Do I need a developer to connect a domain?

Not a developer, but you do need whoever manages your domain’s DNS. If that is not you, the wizard emails the exact records to your DNS admin so they can add them without opening your dashboard. See Do I need a developer.

Will this affect my company's normal email?

No. The records are purely additive: DKIM uses named selectors and SPF sits on a dedicated send. subdomain, so your apex MX, SPF and DMARC are untouched. Your mailboxes, your inbound mail and how your team sends email all carry on unchanged.

Why is my domain still pending after I added the records?

DNS propagation usually takes minutes but can take hours. The two common mistakes are a Host value doubled up with your domain, and a Value with a trailing dot added by the provider. Check both, then press Check now rather than waiting for the next automatic poll.

How long does connecting a domain take?

About ten minutes of clicking, plus DNS propagation. If you have DNS access yourself, most domains are active within fifteen minutes. If you have to send the records to a colleague, it takes as long as they take.

Can two workspaces send from the same domain?

Yes. One workspace owns the domain and another can request access to send from it. The owner approves by email, then the requesting workspace verifies its own address and skips DNS entirely. See Sharing a domain across workspaces.

What happens if I remove a domain from Brilo?

Removing a domain stops Brilo sending from any address on it, immediately. Mail already delivered is unaffected, and your DNS records become inert so you can delete them at your provider. A domain shared with other workspaces cannot be removed by its owner while they still use it.

Integrations for how this fits with the other integrations
Channels overview for the other ways people reach your agent
Send a text or email for what your agent does with it
Email step for using your domain in a campaign
My messages are not sending when something goes wrong

​Before you start

​How it works

​Steps

​You will know it worked when

​Adding more sending addresses

​Sharing a domain across workspaces

​Requesting access to a shared domain

​Approving a request, as the workspace that owns the domain

​Requirements, rules and conditions

​Sending is gated on two conditions

​Public providers are blocked

​One domain has one owner, and can be shared

​Your existing human mail is never touched

​What each record is for

​Replies go to your existing inbox

​Pick a dedicated address, not a person’s

​Reputation, root domain against subdomain

​Limits and timing

​Removing a domain or address

​If it did not work

​FAQ

​Related

Before you start

How it works

Steps

You will know it worked when

Adding more sending addresses

Sharing a domain across workspaces

Requesting access to a shared domain

Approving a request, as the workspace that owns the domain

Requirements, rules and conditions

Sending is gated on two conditions

Public providers are blocked

One domain has one owner, and can be shared

Your existing human mail is never touched

What each record is for

Replies go to your existing inbox

Pick a dedicated address, not a person’s

Reputation, root domain against subdomain

Limits and timing

Removing a domain or address

If it did not work

FAQ

Related