domain.lost

domain.lost fires when a verified domain's DKIM record stops resolving: sends from it fail with domain_unverified until the record is back.

A verified domain’s DKIM record stopped resolving. The domain no longer sends: verified_at is null again and sends from it fail with domain_unverified until the record is back.

The event says only that the key is gone from DNS. It was removed, or replaced — a customer who moved to another platform publishes that platform’s key at the same name. Which of the two is the customer’s business, and the event does not tell.

Payload

Every field, with an example body, is in the domain.lost reference, generated from the API contract.

Handling it

Stop offering the domain as a sender until domain.verified comes back, and show the customer the record they are missing. Nothing else moves: the domain, its records and the mail that went through it stay exactly where they were.