Settings, Addresses, add the domain. Gnesi shows a token and leaves the domain at pending-dns.
At the DNS host for that domain, add:
_gnesi-challenge.example.com TXT gnesi-verify=<token>
Use the token from the screen. Then press verify. Gnesi looks up the TXT record itself. The browser does not decide.
When it matches, you can send as your-local-part@example.com. The local-part is the one on your free @gnesi.io address. SPF, DKIM, and MX do not have to be in place before From works.
If it stays pending, the name is wrong, the value does not match, or DNS has not published the record yet. A domain another account already verified fails closed.