Registers a domain the tenant owns for Domain Protection and returns the DNS to publish. The domain is stored as pending_dns with a fresh reporting address; nothing is proven by registering. Ownership is proven when our observer sees the DMARC record at _dmarc.{domain} contain that address - the row then flips to verified, and to monitoring once aggregate reports arrive. Distinct from /domain/request-domain-verification, which authorises a SENDING domain for simulations; the portal seeds its add-domain picker from /domain/list-domains.

DnsRecords carries the exact records to publish, with host and type. DnsRecords.dmarc.mode says which case applied: publish (the domain publishes no DMARC today, so this is a starting record) or merge-into-existing (the domain already publishes DMARC and this is its own record with our address merged into the rua= list - every tag it already carries is preserved byte for byte; do not replace the policy). DnsRecords.tlsRpt is optional and follows the same rule. Publish, then call check-protected-domain-record, then poll get-protected-domain (or the cheaper list-protected-domains) until state is verified.

Re-adding a domain that was removed REPLACES the row wholesale and mints a NEW reporting address: the state, counters and dismissals reset, and any DNS record still carrying the old address stops routing until it is updated with the new one.

The registry cap (50, reported by list-protected-domains under Limits.domains) counts paused domains. The check is not atomic, so concurrent adds can overshoot it by a few - it is an upper bound, not a billing control. A domain another account has proven control of is refused with DOMAIN_CLAIMED_ELSEWHERE; the refusal never names the holder - contact support.

Requires an Enterprise subscription (ErrorCode ENTERPRISE_REQUIRED; not satisfied by Professional, and get-entitlements.isEnterpriseEntitled does not imply it for partner-managed or staff-trial tenants). Platform Admin or Super Admin and a paid plan.