provisioning

From domain purchase to live inbox in under an hour

agentinbox.pro · 8 min read

There is a specific kind of afternoon every operator knows. You bought the domain in ninety seconds, and then spent four hours in a maze of DNS panels, verification emails that go to an address that does not exist yet, and records that "may take up to 48 hours to propagate." The purchase was instant. Everything after it was mud.

It does not have to be. Done in the right order, a fresh domain goes from checkout to receiving and authenticating mail in well under an hour, and most of that hour is waiting on DNS. The trick is sequencing. Almost all the wasted time in domain setup comes from doing steps in an order that forces you to circle back.

We provision domains constantly, both for our own operations and because inbound routing on custom domains is literally the product we run. Here is the sequence.

01Buy at a registrar with an API and honest pricing

Two things matter in a registrar and neither is the search box. First, renewal price, not promo price. Half the industry sells year one at two dollars and renews at twenty five. Cloudflare Registrar sells at wholesale cost with no markup, roughly ten to eleven dollars a year for a .com. Porkbun is close. Both show the renewal number before checkout.

Second, an API. You may not automate today, but the day you need to provision domain number twelve, clicking through a web panel stops being charming. Cloudflare, Porkbun, and Namecheap all have workable APIs. GoDaddy has upsells.

on choosing the nameFor a sending or receiving domain, the TLD affects deliverability. Stick to .com, .net, .org, or .dev and skip the novelty endings. We wrote up the reasoning separately, but the short version: cheap TLDs are where spam lives, and filters know it.

02Point nameservers first, then never touch the registrar again

If you bought at Cloudflare, DNS already lives there and you skip this step. Otherwise, before adding a single record, decide where DNS will be managed and move the nameservers there now. Changing nameservers after you have configured records means configuring them twice.

Fresh domains usually pick up new nameservers in five to thirty minutes despite the scary 48 hour warnings, because there are no cached records anywhere to expire. This is the one genuinely slow step, so start it first and do the rest of your setup while it propagates.

While you are in the zone, delete the parking records the registrar helpfully created. A fresh zone should be empty. Parked A records pointing at some registrar ad page have a way of surviving into production and confusing everyone eight months later.

03Inbound before outbound

Here is the sequencing insight that saves the most time: set up receiving before sending. Nearly every service you connect later, ESPs, payment processors, app stores, Google Search Console, will want to send a verification message or expect a working address like admin@yourdomain.com. If inbound is not live, each of those becomes its own detour.

The classic route is creating a mailbox at an email host, which means another account, another password, and per-address setup. The faster route, and the one we obviously have opinions about, is catch-all routing: point the domain's MX records at an inbound service once, and every possible address on the domain is instantly live. admin@, billing@, whatever@, all of it, with no per-address provisioning. Verification mails have somewhere to land the moment DNS propagates, and later, real traffic on those addresses can flow into whatever system should handle it.

Two records, typically an MX and a TXT to prove domain ownership, and inbound is done. On a fresh zone this takes effect in minutes.

04Authentication records, all three, before the first send

Now outbound. Whatever will actually transmit your mail, an ESP, a relay like SES, a transactional provider, it will hand you DNS records. Publish all of them in one sitting:

  1. SPF. One TXT record at the root naming your sender: v=spf1 include:yourprovider.example ~all. One record only. Two SPF records on the same name is an automatic fail, and it is a surprisingly common mistake when a second tool "adds" its own.
  2. DKIM. Usually three CNAME records from the provider. Copy them exactly. One gotcha: many DNS panels append the domain automatically, so entering the full hostname produces selector._domainkey.yourdomain.com.yourdomain.com, which resolves to nothing. Enter only the host portion.
  3. DMARC. TXT at _dmarc: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Notice this reporting address just works, because you set up catch-all inbound in step three. This is why inbound goes first.

Then verify with real evidence. Send a message to a mailbox you control and read the authentication headers, or run the domain through a checker. You want three passes with your domain aligned on all three. Do not proceed on hope.

05The fifteen minute verification lap

Before declaring the domain live, one lap around the track:

Fifteen minutes, and every one of these has caught a real mistake for us at some point. The dig commands in particular find the doubled SPF record and the CNAME suffix bug faster than any dashboard.

06What zero-time provisioning changes

Run this sequence once and it is pleasant. The interesting shift happens when you need it repeatedly. Agencies bringing up a branded domain per client. Platforms giving every tenant, or every deployed agent, its own address space. Operators who rotate sending domains as a matter of hygiene. At that point the sequence above stops being a checklist a person follows and becomes an API call a system makes: register, point nameservers, publish records, route inbound, verify, all programmatically.

That is the direction the whole area is moving. A domain with working, authenticated, routed email is becoming something you mint, the way you mint a TLS certificate or a subdomain today, rather than something you hand-assemble. The one hour manual version is worth knowing cold anyway. Every automated pipeline is just this sequence with the waiting removed.

And if your bottleneck today is the inbound half, that is the part we have already turned into two DNS records.

agentinbox.pro is the step three in this guide: catch-all inbound on your domain, every address live at once, delivered to your systems as signed JSON.

Add your domain