Detected Domains

Detected Domains: Finding Unregistered Senders

TL;DR: surfaces domain/subdomain names seen in real report traffic that aren't registered yet, so they don't stay invisible until something breaks.

The rule

A subdomain sending mail under a registered parent's policy can go entirely unnoticed if nobody registers it explicitly — this feature exists because that's literally how a real incident got diagnosed and fixed during development. Two things keep the list free of noise:

• Blocked-sender exclusion — if every source IP behind a detected name is already reviewed and marked "blocked" for the domain it resolves under, it's confirmed spoofing/abuse, not a real subdomain worth registering, and it's excluded.
• Dismiss — an explicit "not mine" action for anything left over that still isn't worth registering (a lookalike, an unrecognized one-off sender), so it stops resurfacing.

Where these names come from: report attribution matches every record by its own header_from — a header_from with no exact registered match, but a registered ancestor, surfaces here as a suggestion to register the subdomain.

DKIM selectors work the same way for a different gap: they aren't discoverable via DNS alone, so unrecognized selectors seen in real reports surface here too, as a prompt to add them.

Where you'll see this

The "Detected domains" panel on each organization's dashboard.

Notifications bell (from v0.2.0)

You don't have to go looking for these. A bell at the top of the sidebar (the top bar on a phone) gets a red dot when the reports turn up something new:

• New domain in your reports: a domain seen in reports that you haven't added or dismissed. Opens Settings → Domains.
• A DKIM selector that isn't monitored yet: a selector that signed the domain's mail in the last 30 days. If the sender using it isn't approved yet, it opens that sender first, so you approve or reject it before monitoring its key. Once approved, it opens the domain's DKIM selectors.

A notification clears itself once it's handled: the domain added or dismissed, the selector added, or its sender blocked. Org admins can also dismiss one. Everyone in the organization sees the bell; members can follow the links. New notifications are looked for every 10 minutes.

See also

• How Reports Are Attributed to a Domain
• Onboarding Your First Organization — adding DKIM selectors

---

← Core Concepts · Home