Skip to main content

Custom domain email is configured

ab-002183 · pre-launch.infrastructure.custom-email
Severity: infoactive

Why it matters

A gmail.com or yahoo.com from-address on a custom-domain site triggers stricter spam filtering at Gmail, Outlook, and Yahoo — DMARC alignment fails because the envelope domain does not match the visible sender. Password resets and transactional mail land in spam or bounce. Users also read the mismatch as amateur-hour, eroding trust on exactly the touchpoints (billing receipts, support replies) where credibility matters most.

Severity rationale

Info because deliverability and perception suffer but no security boundary or compliance rule is directly broken.

Remediation

Replace any @gmail.com / @yahoo.com addresses in contact pages, footers, and FROM_EMAIL env vars with an address on your deployed domain. For inbound mail, use free forwarding from Cloudflare, Namecheap, or your registrar into an existing inbox. For outbound transactional mail, verify the domain in Resend/SendGrid/Postmark and set SPF, DKIM, and DMARC records. Update .env.production so FROM_EMAIL=noreply@yourdomain.com.

Detection

  • ID: pre-launch.infrastructure.custom-email

  • Severity: info

  • What to look for: Count all email-from addresses in the codebase. Enumerate which use the custom domain vs. free email providers. Check whether the project references a custom domain email address in any contact pages, footer components, legal pages, or environment variable names (SUPPORT_EMAIL, CONTACT_EMAIL, FROM_EMAIL env vars in .env.example). Look for email addresses using the deployed domain rather than gmail.com, yahoo.com, or other free providers.

  • Pass criteria: A custom domain email address is referenced in the project (e.g., hello@yourdomain.com, support@yourdomain.com), OR no contact email is surfaced to users. At least 100% of transactional emails must use the custom domain (e.g., noreply@yourdomain.com).

  • Fail criteria: A free provider email (gmail.com, yahoo.com, hotmail.com, etc.) is used as the primary contact or from address for a project deployed to a custom domain.

  • Skip (N/A) when: Skip if the project does not surface a contact email address to users and does not send transactional email from a user-visible address.

  • Cross-reference: For email delivery verification, see email-delivery.

  • Detail on fail: "Project uses a free email provider address for contact/support on a custom domain — creates a less professional impression and limits email deliverability"

  • Remediation: Using a custom domain email (hello@yourcompany.com) instead of a free provider address builds trust and improves email deliverability:

    // lib/email.ts — custom domain email
    const from = "noreply@yourdomain.com"  // Not: "yourbrand@gmail.com"
    
    1. Set up email forwarding through your domain registrar or DNS provider (Google Domains, Cloudflare, Namecheap all offer free forwarding to your existing inbox).
    2. For sending transactional email, configure your email provider (Resend, SendGrid, Postmark) with your custom domain and complete DKIM/SPF/DMARC authentication.
    3. Update your .env / environment configuration to use the custom domain address as the FROM_EMAIL.
    4. Google Workspace or similar services provide full custom domain email with familiar interfaces if you need a managed inbox.

Taxons

History