From name and email accurately identify the sender; not spoofed

CAN-SPAM §5(a)(1) prohibits falsified or misleading From, To, Reply-To, and routing headers. Sending from noreply@sendgrid.net instead of a verified company domain means recipients see an unfamiliar sender — a common spam signal — and the business has no ownership over the sending reputation. CASL Section 6 imposes the same requirement for Canadian recipients. CWE-290 (Authentication Bypass by Spoofing) covers the technical dimension: when the From domain doesn't match the actual sender, SPF/DKIM alignment fails, DMARC policies reject or quarantine the mail, and domain reputation cannot be established.

Configure a verified sending domain in your email provider and enforce it in code at startup.

// lib/email.ts — verified, brand-consistent sender
const FROM_EMAIL = process.env.FROM_EMAIL ?? 'hello@yourproduct.com'
const FROM_NAME  = process.env.FROM_NAME  ?? 'Your Product'

// Fail hard at startup if env is wrong — don't silently fall back
if (!FROM_EMAIL.includes('@yourproduct.com')) {
  throw new Error('FROM_EMAIL must use the verified sending domain')
}

export async function sendEmail({ to, subject, html }: EmailOptions) {
  return client.send({
    from: `${FROM_NAME} <${FROM_EMAIL}>`,
    to, subject, html,
  })
}

Verify domain ownership in your provider's dashboard before sending: SendGrid > Settings > Sender Authentication; Postmark > Sender Signatures; AWS SES > Verified Identities. Until DKIM is configured on your domain, bulk sends will fail Gmail/Yahoo's 2024 requirements.