{
  "id": 10093395,
  "title": "Media Mail Cutovers: Wildcard DNS, Customer Verification, and Tenant Records",
  "url": "https://urgent.news/2026/09/27/media-mail-cutovers-wildcard-dns-customer-verification-and-tenant",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-27T00:00:06.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/urbandonovan1576/media-mail-cutovers-wildcard-dns-customer-verification-and-tenant-records-34n7"
  },
  "original_language": "en",
  "account": "A media publisher must not assume a domain is ready for operation just because a page loads. Newsletters, alerts, and contributor mail also require SPF, DKIM, and DMARC records to be published. Given tight launch windows, the operational constraint favors quick DNS cutovers, but should not bundle every customer into a single verification state. Use wildcards only for the routing layer when every matching name truly shares the same destination and lifecycle. Maintain mail-authentication records and their verification state separately for each customer domain. This approach introduces additional writes and waiting periods but ensures each tenant has a distinct cutover, rollback boundary, and auditor-friendly evidence. A wildcard lookup is insufficient evidence that a specific publisher approved a particular mail policy. When deciding between wildcard DNS and per-tenant records for customer subdomains, remember that wildcards resolve DNS lookups when a more specific name does not exist, which is helpful for uniform traffic routing. However, they do not create an administrative boundary for multiple customer-owned zones and do not indicate who authorized SPF, DKIM, or DMARC changes. Mail authentication reveals the gap by publishing DMARC policy at _dmarc beneath the relevant domain, with evaluation dependent on identifiers and alignment according to RFC 7489. The record is a policy, not a generic connectivity flag. DKIM requires selector-specific public material, while SPF defines which systems may send for a domain. Their lifecycles differ even when the web application behind each customer subdomain is identical. The initial design of pointing *.publish.example at one ingress and marking every customer below it as verified is fast but merges three separate claims: the hostname resolves, the customer controls the requested namespace, and mail policy is ready. Only the first claim is true based on the lookup. Keep those states separate. For a publisher onboarding daily.example, the ideal record is an evidence ledger with fields for the expected record, observed record, authoritative observation time, policy result, and the deployment revision requesting the check. If a web wildcard resolves while two out of three required mail records are visible, marking the tenant as verified would conceal the reason mail activation must wait. Instead, use a status like pending_dns. Avoid treating a green check as verification; each of the three checks should retain its own observation. Treat DNS changes as a state machine, acknowledging uncertainty instead of converting the first successful query into permanent truth. The states should be requested, observed, verified, active, and drifted. observed indicates a checker received the expected data. verified means the policy-specific checks passed. active is an explicit release decision. If a mismatch occurs, move the tenant to drifted, preserving earlier evidence. A TypeScript function can model this decision process, treating observations as input. It avoids provider APIs and focuses on the states. Use retries with bounded backoff after the planned record exists, avoiding repeated DNS record changes that increase churn and complicate the audit trail. Shared wildcard patterns are suitable when names are interchangeable, while discrete tenant entries are better when attribution is required. For mail, discrete records are advisable due to the time-sensitive nature of newsletter launches, despite the operational cost of additional DNS writes.",
  "summary": "A media publisher cannot treat domain onboarding as complete when a page loads. Newsletters, alerts, and contributor mail also need SPF, DKIM, and DMARC to be published and observable, often while a launch clock is already running. The operational constraint changes the DNS choice: cut over quickly, but do not collapse every customer into one verification state. TL;DR: use a wildcard only for the…",
  "key_points": [
    "Media publishers must verify SPF, DKIM, and DMARC records for newsletters and alerts.",
    "Use wildcards only for routing layer, maintain mail-authentication records separately per customer.",
    "Model DNS changes as a state machine with requested, observed, verified, active, and drifted states."
  ],
  "editors_take": "Maintaining separate mail-authentication records and verification states for each customer domain ensures distinct cutovers and evidence, but introduces additional operational complexity and waiting periods for media publishers.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}