# description
A sending/receiving domain on your account. List and detail responses enrich the stored row with the domain's catch-all webhook (webhookUrl/webhookAckMode/webhookStatus) and the account's daily-limit state; write responses return the row alone, so those fields are optional here.

# properties.status.description
Overall verification state. Inbound routing requires at least MX verification; `verified` follows the MX check.

# properties.mx_verified.description
1 once the MX record resolves to MailKite — the gate for inbound mail, webhooks, and routes.

# properties.dkim_verified.description
1 once the DKIM records are accepted by the sending provider.

# properties.zero_retention.description
1 when zero-retention passthrough is on: inbound mail is delivered to the webhook and never stored (no replay, no dashboard history).

# properties.track_opens.description
Domain-wide default for outbound open tracking (a per-send trackOpens overrides it).

# properties.enc_public_key.description
At-rest encryption public key (PEM SPKI, armored OpenPGP key, or X.509 cert). null = encryption off.

# properties.enc_key_alg.description
Key algorithm recorded for the uploaded key ('RSA-OAEP-256', 'PGP', or 'S/MIME'). null = encryption off.

# properties.enc_fingerprint.description
Fingerprint of the uploaded key (sha256 of the SPKI/cert DER, or the OpenPGP fingerprint).

# properties.enc_format.description
Which client-decryptable standard the key is: 'pgp' or 'smime'. null = off or legacy custom envelope.

# properties.provider.description
Email sending provider type currently backing this domain (e.g. 'ses', 'cloudflare'). Assigned by MailKite, never chosen by the caller.

# properties.email_provider_id.description
Registry id of the concrete provider instance backing the domain.

# properties.dns_tokens.description
Provider-specific DNS tokens as a JSON string (e.g. SES DKIM CNAME targets). Feeds the dns record set; null until providers report them.

# properties.last_checked_at.description
When domain verification last ran, in Unix epoch milliseconds (UTC); null when it has never happened.

# properties.created_at.description
When the domain was added, in Unix epoch milliseconds (UTC).

# properties.webhookUrl.description
URL of the domain's catch-all webhook, or null when none is set. List/detail responses only.

# properties.webhookAckMode.description
The webhook's acknowledgement mode: 'lenient' (any 2xx) or 'ack' (2xx + explicit ok). List/detail responses only.

# properties.webhookStatus.description
Health of the webhook's most recent delivery, or null when it has never been exercised. List/detail responses only.

# properties.webhookStatus.properties.message.description
Human-readable detail of the last outcome (e.g. 'HTTP 500').

# properties.webhookStatus.properties.code.description
HTTP status of the last delivery, when relevant.

# properties.webhookStatus.properties.at.description
When the last outcome landed, in Unix epoch milliseconds (UTC); null when it has never happened.

# properties.webhookStatus.properties.consecutiveFailures.description
Current failing streak (0 when healthy).

# properties.webhookStatus.properties.firstFailedAt.description
When the current failing streak began, in Unix epoch milliseconds (UTC); null when it has never happened.

# properties.webhookStatus.properties.unhealthy.description
True once the failing streak passes the unhealthy threshold.

# properties.dailyLimitReached.description
True when the owning account has hit its daily send cap. List/detail responses only.