## Monitor domain verification end to end
1. Add the domain through the domains API and immediately surface the required DNS records (SPF, DKIM, DMARC) to whoever controls the zone. Verification cannot start until every record is in place. Docs: https://resend.com/docs/api-reference/domains/create-domain
2. Tell the tenant or admin exactly which records to add and where, with a copy-paste zone snippet. Most verification failures are one missing or mistyped record, usually DKIM.
3. Subscribe to `domain.created`, `domain.updated`, and `domain.deleted` webhook events so your system tracks domain state without polling the API on a timer. Docs: https://resend.com/docs/webhooks/event-types
4. Gate sending on verified status in your own database. Your send path should refuse to use a domain that is not verified; an unverified `from` domain fails sends and burns your error budget.
5. When DNS changes (provider moves, record rotations), trigger a re-verify through the verify endpoint and watch for the updated event. Do not assume old verification survives a zone rebuild.
6. If verification stalls, check the common causes first: DNS propagation delay, conflicting SPF records (only one SPF record is allowed per domain), and CNAME flattening at the DNS provider. The domain-not-verifying knowledge base page lists the rest.
7. Keep a per-domain audit trail of verification timestamps. When deliverability dips, the first question is whether DNS changed, and the audit trail answers it.