- Shipped
- August 29, 2026 at 2:29 AM UTC
- Author
- Kamo
- Commit
- cc8091c
Host to organization resolution is about to require ownership_verified on the top-level domain row, so that a domain several organizations have merely named routes to the one that proved control of its DNS. Applied to the estate as it stands, that filter would take every organization whose row predates the TXT challenge off the air at once — the flag was optional before, so most live domains simply do not carry it. This grants it to the ones that have already demonstrated they resolve here: DNS checked, a certificate confirmed or ever issued, or a *.kamocrm.com host, which is ours by construction and which the customer could not add a TXT record for anyway. A domain with none of that has never been shown to resolve here, so no traffic can be reaching it and leaving it unverified breaks nothing. That is exactly the case the new rule exists for. MUST RUN BEFORE the shared-library filter ships.