Two sub-groups of vetta identity: domains are org-level (a domain is shared), email inboxes belong to a persona.
vetta identity domain
Domains are org-level — there is no --identity flag on this sub-group.
The three status fields move independently, and that is the point — a domain can be sending (dns_status: provisioned) while inbound is still broken (inbound_status: failed). Read all three before assuming a domain is healthy.
verify is idempotent — run it as often as you like while DNS propagates.
vetta identity email
Outbound email depends on a configured comms provider. Where one is not configured the send surface answers 501 not_implemented and holds no rows to read. This is a deployment state, not a bug in your call — a persona read stays healthy either way, so identity show succeeding tells you nothing about whether email send will.Check by attempting one send in a test org rather than assuming; a 501 here is a platform configuration answer and no retry will change it.
Inbound continues to work whenever the domain’s inbound_status is healthy, independently of the outbound path.