Custom domain email is configured
Why it matters
A gmail.com or yahoo.com from-address on a custom-domain site triggers stricter spam filtering at Gmail, Outlook, and Yahoo — DMARC alignment fails because the envelope domain does not match the visible sender. Password resets and transactional mail land in spam or bounce. Users also read the mismatch as amateur-hour, eroding trust on exactly the touchpoints (billing receipts, support replies) where credibility matters most.
Severity rationale
Info because deliverability and perception suffer but no security boundary or compliance rule is directly broken.
Remediation
Replace any @gmail.com / @yahoo.com addresses in contact pages, footers, and FROM_EMAIL env vars with an address on your deployed domain. For inbound mail, use free forwarding from Cloudflare, Namecheap, or your registrar into an existing inbox. For outbound transactional mail, verify the domain in Resend/SendGrid/Postmark and set SPF, DKIM, and DMARC records. Update .env.production so FROM_EMAIL=noreply@yourdomain.com.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Pre-Launch Checklist Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
Taxons
History
- 2026-04-18·v1.0.0·Initial import from pre-launch·automated