Comail, Marque, and atproto

Comail uses atproto for identity, but it still sends ordinary email through ordinary DNS. Marque can make the DNS part easier when your domain is registered there.

You do not need to understand the entire atproto network to use Comail. This page explains the few pieces that appear during domain setup.

In brief

Comail sends and receives email. It verifies your domain, signs outgoing messages, tracks delivery problems, and applies sending limits.
Marque is a separate domain registrar and DNS service built for atproto. If your domain is managed there, it can publish Comail’s DNS records for you.
Your PDS hosts the public records for your atproto account. With your approval, Comail can publish a record describing the domain setup there.
The Atmosphere is the wider network of apps and services built on the AT Protocol. You do not need a separate Atmosphere account to use Comail.

Marque is optional. A domain registered anywhere else works with Comail through the normal copy-and-paste DNS setup.

The four names you will see

Your handle and DID

Your handle is the readable name you sign in with, such as alice.bsky.social or alice.example. Your DID is the stable account identifier underneath it, such as did:plc:abc123….

Comail connects domains, settings, and permissions to the DID because a handle can change. Your DID is not an email address and is not shown to recipients.

Your PDS

A Personal Data Server, or PDS, hosts your atproto account and its public repository. Bluesky accounts normally use a Bluesky-operated PDS; community and self-hosted accounts may use another one.

During setup, Comail may ask your PDS for permission to publish a public email.atmos.attestation record. That record says which domain this account enrolled and which email-signing keys Comail should verify. It does not contain message bodies, recipient addresses, or your API key.

Comail

Comail is the email service. It generates the required DKIM, SPF, DMARC, and domain-control values, then checks public DNS to make sure they were published correctly.

Comail is operated by Atmosphere Mail LLC. “Atmosphere” is also commonly used as the name for the wider atproto ecosystem; it does not mean that every Atmosphere service is operated by Comail.

Marque

Marque is an independent domain registrar operated by Padding Labs LLC. It stores editable DNS instructions as public records in your atproto repository and synchronizes them to the authoritative DNS servers for your domain.

When Comail recognizes a domain managed by Marque, it offers an automatic setup path. You approve the change through your atproto account; Comail adds its records to the existing Marque DNS record, and Marque publishes the result. You never give Comail a registrar password.

What happens during automatic Marque setup

Comail checks your public atproto records to confirm that the domain is registered through Marque.
You choose Let Marque add the records and approve the request through your atproto account.
Comail adds its DNS entries to the domain’s existing at.marque.dns record. Existing unrelated entries are kept.
Marque synchronizes that record to the domain’s authoritative DNS servers.
Comail checks public DNS just as it would during manual setup.
When the checks pass, the domain begins its normal 14-day sending warm-up.

Automatic setup changes only the DNS records needed for Comail. It does not transfer the domain, change its owner, move your website, or let Marque relay or store your messages.

What Comail publishes

The exact bundle depends on the domain, but normally includes:

DKIM: public keys used by inbox providers to verify Comail’s signatures.
SPF: permission for Comail’s relay to send for the domain.
DMARC: instructions for mail that fails authentication and an address for aggregate reports.
Domain control: a TXT record connecting the domain to your DID when your handle alone does not prove the connection.
Attestation: a public atproto record connecting your DID to the Comail enrollment.

The DNS records and attestation are public by design. Private DKIM keys, API keys, message contents, and recipient addresses are not published to your PDS or DNS.

Manual setup is equivalent

If you choose manual setup, Comail shows the same DNS values for you to copy into Cloudflare, Porkbun, Route 53, or another DNS provider. The verification checks, sending limits, and 14-day warm-up are the same.

Using Marque does not buy a higher sending limit, improve reputation, or skip verification. It only removes the DNS copy-and-paste step.

Attestations and labels

An attestation is your account’s public statement that it enrolled a domain with Comail. Comail asks you to publish it after the DNS values are ready.

A label is a signed statement from Comail’s atproto labeler about your DID. For example, a label can say that DNS authentication was verified. Other atproto services can inspect these labels, but they do not replace DKIM, SPF, or DMARC checks performed by email providers.

Deleting the attestation or removing required DNS records can cause the corresponding label to be withdrawn. It does not silently delete the domain from your registrar.

See Atproto labels for the exact labels Comail currently issues.

Address offerings are a separate feature

An address offering lets a domain owner make receiving addresses available to other atproto accounts. For example, a community could allow its members to request name@community.example.

An offering controls:

who may request an address;
whether requests need approval;
how many addresses can be issued; and
whether an address receives mail, sends mail, or both.

Offerings do not affect the domain’s sending warm-up or reputation. The current builder-console configuration is stored in Comail; publishing it to the owner’s PDS is planned but not implemented yet.

Choices during setup

If Marque manages the domain, choose automatic or manual DNS setup. Both are safe and reversible.
If another provider manages the domain, use manual setup.
Approve the attestation if you want the enrollment represented in your atproto account and the related labels issued.
Configure an address offering only if you want other people to request receiving addresses on the domain.