- Shipped
- September 16, 2026 at 5:51 PM UTC
- Author
- Kamo
- Commit
- 20c6f4b
A sending domain (news.acme.com) is kept in the org's encrypted bulk provider blob with its DKIM key. SendingDomainChecker reads what receivers will see — SPF evaluated for the shared relay's address, our key at its selector, a DMARC policy at the domain or a parent — for the recommended records (a CNAME to contact.kamocrm.com, the DKIM TXT, DMARC) and the alternative SPF TXT + MX, and names the usual mistakes: a doubled zone name, a proxied Cloudflare CNAME, a name that already has records, a CNAME elsewhere, two SPF records, too many lookups, a key pasted short, a malformed or inherited policy, and 'your record is right, KamoCRM's side is not live yet'. SendingDomainService adds (cleaning a pasted URL or address, refusing kamocrm.com to tenants), checks, removes (not while it is the default sender's or an active campaign's), and moves status: PENDING/FAILING → VERIFIED on a pass; VERIFIED → FAILING only after two failures six hours apart; a DNS outage changes nothing. It answers the send path — ORG_VERIFIED (with the signing key), PLATFORM_MANAGED (hello.kamocrm.com, for KamoCRM only) or UNVERIFIED — and builds the shared relay's sender map of verified domains. Changes publish ****************