Verifying a sending domain now takes one TXT record too
Alongside the DKIM CNAMEs, a domain needs a TXT record at _sendheron-challenge.yourdomain.com set to sendheron-verification= plus the token shown when you add it. It can be removed once verification succeeds.
Why DKIM alone was not enough
We send through a shared sending account. In that arrangement DKIM records prove a domain is set up correctly, but they never prove who set it up: anybody who can publish the CNAMEs can pass the check, and the person who can publish them is not always the person who should be sending as that domain.
The TXT record closes that gap, and it closes it once. The challenge is a token bound to the workspace that requested it, so verifying a domain in one workspace does not verify it anywhere else by accident.
When no DNS is needed at all
A domain your organization has already verified in another workspace needs no records. That precedent is trusted, so adding it to a second workspace is instant. The check exists to establish ownership, and ownership does not need re-establishing inside the same organization.
Also in this release
- A blocked send caused by your own setup, an unverified sending domain, a paused organization or an archived workspace, now parks each sequence enrollment as PAUSED at the step it reached with pausedReason recording why, rather than cancelling it. Fix the cause and they resume on their own, with no API call and no re-enrollment. Blocks caused by the recipient still end the enrollment, because an unsubscribe, a bounce or a complaint is not something you can fix.
Related: Verify a sending domain, Check a domain's DKIM records
Private beta
See the next one land
Beta members get the release note in the same batch email that opens their account.