2026-09-13

A sending policy, monitored domains, and the decision the answer now makes

Every email answer ends with ok_to_send and blocked_by from the account's own sending policy; up to 500 domains can be monitored for mail-setup drift; fields narrows an answer; the dashboard shows a bulk run's summary; a second handshake path stands in when the first is unavailable; two more free tools check DKIM and MTA-STS; typo suggestions read more domains; bounce reports feed the not-found memory; and the status page measures reasons and confidence.

The answer makes the decision now: ok_to_send and blocked_by, 46 fields in all. The score was always arithmetic, and the decision was always yours to write as an if-chain. A sending policy writes it once: the signals that block whenever they fire, a ceiling on the score, and a floor for a catch-all or unverified mailbox's confidence, applied in that order after the verdict. An undeliverable verdict never passes; blocked_by names the rule that stopped anything else — undeliverable, the blocking signal's own name, risk_score or mailbox_confidence. Until an account sets one, the published defaults apply (disposable, likely_typo, parked_domain, mx_blocklisted and no_reply block, and so does any score over 60), and the guest demo, the sandbox key and the test addresses answer with those. The policy belongs to the account and reaches every channel it is billed for — single and batch lookups, bulk runs (two more result columns and a blocked count in the summary), monitors, the form widget and the dashboard. GET, PUT and DELETE /api/v1/email/policy read, change and reset it; the Sending policy tab on the verification page edits the same three rules.
Monitored domains. A domain's mail setup drifts: a provider is switched, a DMARC policy loosened, a registration lapses into a parking page, a mail host lands on a blocklist. POST /api/v1/email/domain-monitors saves up to 500 domains and re-checks them daily, weekly or monthly through the domain lookup, billed the same way — one credit when a domain accepts mail, nothing when it is dead, repeats inside seven days free, so a daily cadence costs at most a credit per domain a week. Each domain answers ok, flagged, dead or invalid with every flag that fired: parked, blocklisted, expiring, no_spf, no_dmarc, and five compared with the previous run (provider_changed, spf_changed, dmarc_changed, dkim_lost, mta_sts_lost). The first run baselines; after that an alert goes out only for a domain that was ok and no longer is, or gained a flag it did not have, by email and, when set, by the same signed webhook the other monitors post. List, get, update, run and delete endpoints, a Domains tab on the verification page, and the SDKs carry it.
fields on the single and browser endpoints. A comma-separated list of the keys you want, answered in the answer's own order; unknown names are ignored, sources stays only when named, meta is never narrowed. With 46 fields and a batch of fifty, an answer should be as wide as the caller needs.
The bulk summary on the dashboard. A finished run's verdict and risk splits, its most frequent reasons, providers and domains, and how many rows carried each signal, drawn beside the run.
A second handshake path. When the first handshake path is unavailable — the circuit breaker open, a transport failure — a second one now answers the same probe, so a partner outage costs latency rather than verdicts. Neither is named anywhere a reader can see, as before.
Two more free tools. A DKIM checker at /tools/dkim-checker lists the common selectors that publish a key; an MTA-STS checker at /tools/mta-sts-checker reads MTA-STS, TLS-RPT and BIMI beside the SPF all-qualifier and the DMARC pct and reporting address. Both run on the domain report the domain tools already share.
Typo suggestions read more than the big providers. did_you_mean now draws on the thousand most-linked domains and the domains an account verifies most, so acme.co is corrected to acme.com; a domain outside the provider list is suggested only when its own mail servers accept mail. The bundled first-name list gained the MIT male list, so a lone male first name reads as a first name rather than a surname.
Bounce reports feed the not-found memory. A reported bounce whose provider text says the mailbox does not exist (a 5.1.1 code, "user unknown" and its kin) is recorded the way a probe's not-found answer is, so a later mailbox that exists again reads as recycled from day one; a one-off command backfills the last six months of stored reports.
Measured reasons and confidence. The status page's measured block gains two tables: the delivered share per verdict reason, and per mailbox-confidence bucket (under 40, 40 to 69, 70 and over), each published only under the same floors as the verdict figures — a hundred outcomes from three accounts, none holding more than half — and never called accuracy.

markdown version: /changelog/2026-09-13-a-sending-policy-and-domain-monitors.md · atom feed: /changelog.atom

All releases