fix(sales): bind outbound sender trust to Resend DKIM selector - #141
Conversation
The outbound mail path still routes through Cloudflare Email Routing, which forwards inbound mail only and blocks cold email until sender trust is clean. PR #102 already diagnosed the inbound-only mail path and explained that the physical address and DKIM selector cannot be invented when no business address is published and no DKIM records exist in DNS. DNS now exposes a real DKIM record at resend._domainkey.tinystudio.io (`p=` RSA key published by Resend), so the sender trust check can be populated from the live selector instead of guessing. Save dkimSelector as `resend` in agency-config.json and widen the discovery list to cover the modern outbound providers a founder-led studio is most likely to use (Resend, Postmark, Mailgun, Amazon SES, Mailjet, Brevo, SparkPost, Klaviyo, HubSpot, Mailchimp, Elastic Email, MailerSend, Fastmail, Tutanota). The selector list still does not invent values; it only lets the check discover a real selector the provider has already published. After this change: - DKIM: ready (resend._domainkey.tinystudio.io) - Sender trust warnings drop from three rules to one: the postal address. - export-sender-setup-guide now reports the actual configured selector (or a discovered candidate) in the dry-run command and adapts the fix-order steps to the current state, so the guide stops telling the operator to enable DKIM that is already enabled. - The four tracked operator artifacts that read the sender setup state (11-10-proof-run, market-parity-readiness, competitive-proof-matrix, market-parity-benchmark-2026) and the sender-setup-guide markdown and HTML are regenerated through the same fixed-clock path the active operator surface gate uses, so the byte-identical check stays green and the operator sees the actual sender trust state. senderPhysicalAddress stays empty: no physical address is published on tinystudio.in or any privacy/terms/contact surface, so the value cannot be invented. The remaining sender warning points at that single blocker.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
Warning Review limit reached
Next review available in: 59 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Free Run ID: 📒 Files selected for processing (10)
Note 🎁 Summarized by CodeRabbit FreeYour organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login. Comment |
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
… (PR #141), postal address blocked on operator fact (#174) (#174) Lane 1 reverification report: dkimSelector=resend is already set on main (PR #141) and the live resend._domainkey.tinystudio.io record resolves; SPF, DMARC, and DKIM all verify. The only remaining sender warning is the empty senderPhysicalAddress, which requires a real published business address (CAN-SPAM) that no code change can supply. No product files changed. Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
…xed in PR #141, postal address blocked on operator fact (#173) (#173) Lane 1 verification report: dkimSelector=resend is already set on main (PR #141, fcf5ff3) and the live resend._domainkey.tinystudio.io record resolves; SPF, DMARC, and DKIM all verify. The only remaining sender warning is the empty senderPhysicalAddress, which requires a real published business address (CAN-SPAM) that no code change can supply. No product files changed. Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
… (PR #141), postal address blocked on operator fact (#177) (#179) Lane 1 third re-verification report: dkimSelector=resend is set on main (PR #141, fcf5ff3) and the live resend._domainkey.tinystudio.io record resolves; SPF, DMARC, and DKIM all verify. The only remaining sender warning is the empty senderPhysicalAddress, which requires a real published business address (CAN-SPAM) that no code change can supply. No product files changed. Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
Nish's direct decision 2026-08-20: all outbound email runs on Cloudflare, not Resend. Flips dkimSelector from resend to cf2024-1 and regenerates the sender setup guide under the tracked-artifact pinned clock. Live send:setup confirms the cf2024-1 DKIM record on tinystudio.io; the only remaining sender-trust warning is the physical postal address. Reverses #141's provider choice; supersedes closed #60.
1 participant
What
resend._domainkey.tinystudio.io.dkimSelector: "resend"ingrowth-brain/ops/agency-config.json.scripts/check-outbound-sender-setup.mjsto cover modern outbound providers (Resend, Postmark, Mailgun, Amazon SES, Mailjet, Brevo, SparkPost, Klaviyo, HubSpot, Mailchimp, Elastic Email, MailerSend, Fastmail, Tutanota) so a real selector is no longer hidden when a less-common default is in play.scripts/export-sender-setup-guide.mjsso the fix-order, the dry-run command, and the DKIM discovery row all reflect the actual configured state.Why
PR #102 already established that senderPhysicalAddress and dkimSelector cannot be invented when no business address is published and no DKIM records exist in DNS. Since then, Resend has been connected for outbound mail and the resend._domainkey.tinystudio.io TXT record now carries a valid p= key. That selector is a real DNS-discovered value and can safely be saved. The physical postal address still cannot be invented because no business address is published anywhere on tinystudio.in.
Result
npm run send:setup warnings drop from three to one:
The only remaining blocker is the published postal address.
Verification
Out of scope