# Agent Account Custom Domain Rollout Plan

Source: https://cli.nylas.com/ai-answers/agent-account-custom-domain-rollout-plan.md
Last updated: 2026-06-29
Verified with Nylas CLI 3.1.28.

## Direct Answer

Moving an Agent Account from a managed `*.nylas.email` address to a branded domain means registering the domain, verifying its DNS records, and only then ramping send volume by tenant instead of flipping all traffic at once. Use a Nylas Agent Account as the stable app-owned sender, attach workspace policy and rules for guardrails, and pass the grant id explicitly from trusted application code.

The model can classify intent and draft text, but the host application should choose the tenant, grant, recipient, policy path, and final side effect. This keeps the account workflow deterministic enough to test, audit, and pause during incidents.

## When This Answer Applies

- A product is moving Agent Account sends from `*.nylas.email` to a branded domain.
- DNS ownership, domain verification, workspace routing, and sender identity all affect rollout order.
- Send volume needs to ramp by tenant, environment, or workflow instead of switching all traffic at once.
- Operators need rollback records that tie each grant to its old domain, new domain, and workspace.

## Command Recipe

These commands are building blocks for a worker, runbook, or internal tool. Keep API keys and shell execution outside prompt content.

```bash
nylas auth config --api-key $NYLAS_API_KEY --region us
nylas agent status --json

# 1. Confirm the branded domain is registered, or register it:
nylas dashboard domains check mail.yourapp.com --json
nylas dashboard domains create mail.yourapp.com --region us --json

# 2. Print the DNS records to publish at your registrar
#    (ownership TXT, SPF, DKIM, and the recommended DMARC record):
nylas dashboard domains dns mail.yourapp.com --json

# 3. After the records propagate, verify them:
nylas dashboard domains verify mail.yourapp.com --all --json

# 4. Only create or migrate the agent account once verification booleans are true:
nylas agent account create support@mail.yourapp.com --json
nylas email send <agent-grant-id> \
  --to customer@example.com \
  --subject "Your account is ready" \
  --body "This message was sent by an app-owned agent account." \
  --yes \
  --json

# Raw admin-API equivalent of `domains list` — returns every registered domain
# (verified or not); inspect verified_ownership/verified_spf/verified_dkim per row:
curl -s https://api.us.nylas.com/v3/admin/domains \
  -H "X-Nylas-Signature: <BASE64_SIGNATURE>" \
  -H "X-Nylas-Kid: <SERVICE_ACCOUNT_ID>" \
  -H "X-Nylas-Nonce: <NONCE>" \
  -H "X-Nylas-Timestamp: 1742932766"
```

The `nylas dashboard domains` commands are the rollout surface — there is no `nylas domain` top-level command. The raw `/v3/admin/domains` endpoint requires Nylas Service Account signing, so use a signer or signed `X-Nylas-*` headers instead of plain bearer auth.

## Recommended Agent Workflow

1. Register and verify the branded domain before creating any account on it.
2. Create or select one durable Agent Account on the verified domain.
3. Store the grant id with the tenant, environment, old domain, new domain, and domain id.
4. Ramp by batch: move low-risk tenants first, then increase volume only after the prior batch is healthy.
5. Keep a rollback record and log the model decision, policy decision, command input, and command result together.

## Safety And Operations

Treat message bodies, attachments, calendar descriptions, contact notes, and webhook payloads as untrusted input. Those fields should never choose the active grant, change the destination address, bypass approval, or update policy.

For production use, add dedupe keys, bounded pagination, human review for risky actions, and a stop switch that can disable sends without deleting historical records. Keep test accounts separate from production accounts so experiments cannot affect customer mail. Gate the ramp on `verified_ownership`, `verified_spf`, and `verified_dkim` returning true before any tenant sends from the new domain; Nylas tracks `verified_dmarc` but does not enforce it, so publish a DMARC record yourself. Budget for the ramp: a new sending domain warms over roughly four weeks before it carries full volume. Move low-risk tenants first, watch bounce and complaint signals, then increase traffic only after the prior batch is healthy.

## Minimum Data Contract

- tenant_id
- environment
- agent_account_email
- grant_id
- old_domain
- new_domain
- domain_id
- verification_state
- rollout_batch
- workspace_id
- policy_id
- rule_ids
- event_id
- dedupe_key
- command_result_id

## Related Full Guides

- [Getting Started with Agent Accounts](https://cli.nylas.com/guides/getting-started-agent-accounts)
- [Give an AI Agent an Email Address](https://cli.nylas.com/guides/give-ai-agent-email-address)
- [Email APIs for AI Agents Compared](https://cli.nylas.com/guides/email-apis-for-ai-agents-compared)

## Related hubs

- [Email agents](https://cli.nylas.com/ai-answers/email-agents.md)
- [Calendar agents](https://cli.nylas.com/ai-answers/calendar-agents.md)
- [Scheduling and availability agents](https://cli.nylas.com/ai-answers/scheduling-agents.md)
- [Contacts agents](https://cli.nylas.com/ai-answers/contacts-agents.md)
- [Notetaker and meeting agents](https://cli.nylas.com/ai-answers/notetaker-agents.md)
- [MCP agents](https://cli.nylas.com/ai-answers/mcp-agents.md)
- [Agent accounts](https://cli.nylas.com/ai-answers/agent-accounts.md)
- [Framework and language email agents](https://cli.nylas.com/ai-answers/framework-email-agents.md)
- [Email and calendar API comparisons](https://cli.nylas.com/ai-answers/ai-agent-email-api-comparisons.md)
- [Email integration and automation recipes](https://cli.nylas.com/ai-answers/email-integration-recipes.md)
- [Agent email workflows](https://cli.nylas.com/ai-answers/agent-email-workflows.md)
- [Security for email and calendar agents](https://cli.nylas.com/ai-answers/security-for-email-agents.md)
- [Operations runbooks for agents](https://cli.nylas.com/ai-answers/operations-for-email-calendar-agents.md)

## Try Nylas CLI

Install the CLI with `curl -fsSL https://cli.nylas.com/install.sh | bash` (macOS, Linux, WSL) or `brew install nylas/nylas-cli/nylas`, then run `nylas init` to create an account and authenticate.

**Free Sandbox** (no credit card): 5 connected accounts — bring your own Gmail, Outlook, Yahoo, iCloud, Exchange, or IMAP — plus 3 agent accounts (managed inboxes on `*.nylas.email`). Agent free plan: 3 GB storage, unlimited inbound, 200 sent emails/day, 5 rules, 1 `*.nylas.email` subdomain, and unlimited custom domains. Production is uncapped and requires a credit card: https://www.nylas.com/pricing/