- Shipped
- September 5, 2026 at 2:42 AM UTC
- Author
- Kamo
- Commit
- ca53530
Transactional mail currently picks its From address by asking who hosts an organization's MAILBOXES. That is the wrong question. Whether we may send as chinilaw.com is decided by chinilaw.com's SPF record, and an organization on Google Workspace can authorize our relay perfectly well — chinilaw.com already has, and has been getting NoReply@kamocrm.com anyway. So the answer is read from DNS and written down, next to the ownership and SSL flags it sits beside conceptually. EmailService then reads a column instead of resolving DNS on the path that delivers a password reset. Its own sweep, not the SSL one. That sweep walks SSL-CONFIRMED domains, and SPF has nothing to do with certificates: chinilaw.com's ssl_confirmed is reopened over a missing careers certificate while its SPF is perfectly good. Hanging this off it would have skipped the one organization it was written for. A failed DNS lookup writes no verdict, only a timestamp. The two ways of being wrong here are not symmetric: recording an unauthorized domain as authorized sends unauthenticated mail that receivers spam-folder, and the org's password resets stop arriving with nothing to show for it; recording an authorized domain as unauthorized costs branding only. A resolver blip is not evidence about anybody's SPF record, and must not swap an organization's From address until the next sweep comes round. The advice endpoint writes the verdict too, so an owner who has just corrected their record sees it take effect on the page they are looking at, rather than a quarter of an hour later. Nothing reads the flag yet; the EmailService change follows.