- Ya
- 4 Septemba 2026, 16:46 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 14f8b42
Transactional mail always went out as NoReply@{org primary domain} through our own relay. That is only safe while Kamo hosts the org's mail: then we control the domain's SPF and DKIM. An org that moves its mailboxes to Google Workspace, Microsoft 365 or Zoho keeps the same From, but its SPF now names that provider instead of our relay and we hold no DKIM key for it, so every system email becomes unauthenticated mail claiming to be from a domain we do not send for. Receivers spam-folder it, and reject it outright the moment the domain publishes DMARC stricter than p=none. Harmony Home Loans hit exactly this: harmonyhomeloans.net now has MX -> smtp.google.com and SPF "include:_spf.google.com ~all", which does not cover our sending IP, so their password-reset mail could not be trusted by Google or by the personal gmail/yahoo addresses on their accounts. Orgs we host keep sending as their own domain, unchanged. Everyone else now sends from the platform's aligned domain under the org's name, with Reply-To pointing back at the org, so the branding survives and the mail arrives: From: "Harmony Home Loans" <NoReply@kamocrm.com> Reply-To: NoReply@harmonyhomeloans.net An org with no provider row has never chosen one and is already treated as KamoMail everywhere else, so it is unaffected; a provider lookup that fails falls back to the old behaviour rather than blocking a password reset. This also wires up the replyTo argument sendToUser has always accepted and never used.