## Onboard a tenant domain end to end
1. When a tenant connects their domain, create it through the domains API with the tenant's domain name. Show the tenant the DNS records Resend returns and wait for them to add all of them; verification fails on any missing record. Docs: https://resend.com/docs/knowledge-base/setting-up-resend-for-multi-tenants
2. Do not poll verification in a tight loop. Listen for the domain.verified webhook event instead; domain verification is asynchronous and DNS propagation takes time.
3. Once verified, create an API key with `permission` set to `sending_access` and `domain_id` set to the tenant's domain id. This key can only send from that domain, so a leaked tenant key cannot impersonate other tenants.
4. The API key token is returned only once at creation. Store it in your secrets manager immediately; you cannot retrieve it again, and re-minting means rotating the tenant's key.
5. On every send for that tenant, attach a tag with your internal tenant id. When webhook events arrive for the shared account, the tags array tells you which tenant each event belongs to.
6. Put each new tenant domain on the warm-up ramp before real volume, and prefer a sending subdomain so the tenant's root domain reputation is protected.
7. Track per-tenant bounce and complaint rates separately. In a shared account one bad tenant can degrade deliverability for everyone, so set a per-tenant complaint threshold that auto-pauses their sends pending review.
8. If a tenant leaves, delete their domain from your account and revoke their API key. A domain must be deleted from the original account before it can be verified elsewhere, so do this cleanup promptly to avoid re-verification delays.