- Shipped
- August 5, 2026 at 7:22 PM UTC
- Author
- Kamo
- Commit
- be1e408
A lead whose e-mail was set to noreply@kamocrm.com matched every message that address had ever sent — one lead record surfaced the company's entire outbound mail stream (126 associations across 6 leads in production). Two faults, both closed here. The resolver decided "is this the company?" from email_provider_domains, mailboxes, aliases and member addresses. That table is only populated for orgs that provisioned mail through Kamo — it is EMPTY for most, including the org that hit this — so an address on the org's own domain was classified as an outside party. It now reads org_domains, which is always populated because it is what the tenant is reached on, and matches by APEX: kamocrm.com owns jim@kamocrm.com and bob@mail.kamocrm.com alike. Matching is on a dot boundary, so notkamocrm.com and kamocrm.com.evil.net are still external. The rule was also too narrow. Refusing only threads where EVERY participant was internal never fired here, because noreply's messages all have a real external recipient. A company address is now never a match candidate at all: the lead side of a communication is the customer by definition, whoever is typed into the lead's e-mail field. Aliases, shared mailboxes and unattended senders are all covered, by address or by apex. Tests pin the apex rule including the look-alike domains a naive suffix match would swallow, and the empty-provider-domains shape that caused the incident.