uMail Domain Verification & DNS Setup

This guide documents the complete process for verifying the mallnline.com domain with Resend and configuring DNS authentication records (SPF, DKIM, DMARC) at Network Solutions. These records ensure outbound transactional emails from the alerts subgraph are properly authenticated and delivered to recipients' inboxes.

Policy: @mallnline.com is reserved for internal platform use only (e.g., noreply@, support@, press@). Malet Owner addresses will use a separate domain in future uMail phases.

Prerequisites

• Access to Network Solutions Account Manager (domain owner)
• Access to Resend Dashboard (with RESEND_API_KEY)
• mallnline.com domain owned and active

Architecture Overview

The Mallnline email infrastructure uses a dual-provider model:

DNS authentication records (SPF, DKIM, DMARC) tell receiving mail servers that Resend is authorized to send emails on behalf of @mallnline.com. Without these records, emails may land in spam or be rejected entirely.

┌─────────────────┐     ┌──────────────┐     ┌─────────────────┐
│  alerts subgraph│────▶│  Resend API  │────▶│ Recipient Inbox │
│  (NestJS)       │     │  (outbound)  │     │ (Gmail, etc.)   │
└─────────────────┘     └──────────────┘     └─────────────────┘
                              │                      │
                              │                      ▼
                              │               ┌─────────────┐
                              └──────────────▶│ DNS Check:  │
                                              │ SPF ✓       │
                                              │ DKIM ✓      │
                                              │ DMARC ✓     │
                                              └─────────────┘

Step 1: Retrieve DNS Records from Resend

1. Log in to the Resend Dashboard
2. Click "Add Domain" → enter mallnline.com
3. Resend generates the DNS records you need to add

Resend provides 4 records across 3 categories:

Toggle "Enable Sending" to ON. Leave "Enable Receiving" OFF — inbound mail is handled by Network Solutions/Roundcube.

⚠️ Do NOT enable receiving — this would require changing MX records and would break the existing info@mallnline.com Roundcube inbox.

Step 2: Navigate to Network Solutions DNS Panel

1. Log in to Network Solutions Account Manager
2. Click Domains in the left sidebar
3. Click on mallnline.com
4. Scroll down to "Advanced Tools"
5. Click "Manage" next to "Advanced DNS Records"

⚠️ Do NOT use "Custom Nameservers" or "Manage Nameservers (DNS)" — those control which nameservers run the domain. The "Advanced DNS Records" panel is for adding individual DNS records.

The existing records you'll see:

Step 3: Add Resend DNS Records

Click "+ Add Record" (top right) and add each record from the Resend dashboard.

Record 1: DKIM (TXT)

Network Solutions auto-appends .mallnline.com, creating the full record: resend._domainkey.mallnline.com

Record 2: SPF — MX Record

Record 3: SPF — TXT Record

Record 4: DMARC — TXT Record

Step 4: Verify in Resend

1. Return to the Resend dashboard
2. Click "I've added the records"
3. Resend will check DNS propagation — this usually completes within minutes but can take up to 48 hours
4. Once verified, the domain status will show ✅ Verified

Verification via CLI

You can also verify DNS propagation from the terminal:

# Check DKIM
dig resend._domainkey.mallnline.com TXT +short

# Check SPF (subdomain)
dig send.mallnline.com TXT +short
dig send.mallnline.com MX +short

# Check DMARC
dig _dmarc.mallnline.com TXT +short

# Check existing MX (should be unchanged)
dig mallnline.com MX +short
# Expected: mx.mallnline.com (priority 30)

Step 5: Update Environment Variables

Once Resend confirms domain verification, the FROM_EMAIL environment variable is already configured:

# .env (root) and apps/auth/.env
FROM_EMAIL=noreply@mallnline.com

The fallback in gmail-alerts.service.ts also defaults to noreply@mallnline.com:

const from =
  this.configService.get('FROM_EMAIL') || 'noreply@mallnline.com';

⚠️ Do not deploy the noreply@mallnline.com sender until Resend verification is complete. Resend will reject emails from unverified sender domains.

Email Delivery Test

After verification, test end-to-end delivery:

npx -y tsx apps/alerts/scripts/verify-email-delivery.ts your-email@gmail.com

Check the received email headers for:

• SPF: PASS
• DKIM: PASS
• DMARC: PASS

Platform Functional Mailboxes

These addresses are provisioned via Network Solutions Standard Email forwarding (same mechanism as dev@mallnline.com → Gmail):

Troubleshooting

Records not propagating

DNS propagation can take up to 48 hours. If records aren't showing after a few hours:

1. Double-check the Host Name field — Network Solutions auto-appends .mallnline.com
2. Ensure there are no typos in the TXT values (copy-paste directly from Resend)
3. Try lowering TTL to 1 Hour for faster updates

"Custom Nameserver" confusion

Network Solutions has multiple DNS-related pages:

• Custom Nameservers — Creates ns1.yourdomain.com records. Not what you need.
• Manage Nameservers (DNS) — Changes which DNS servers run your domain. Not what you need.
• Advanced DNS Records — Adds individual A/CNAME/MX/TXT records. This is the correct page.

Emails still going to spam

If SPF/DKIM/DMARC all pass but emails land in spam:

• Check sender reputation via Google Postmaster Tools
• Ensure FROM_EMAIL matches the verified domain (noreply@mallnline.com)
• DMARC is in p=none (monitoring) mode initially — escalate to p=quarantine after 2-4 weeks of clean reports

Related

• Alerts Resilience — DLQ retry system and delivery tracking for the alerts subgraph
• Invite Notification Pipeline — Organization invite emails using Resend
• Alert Templates UI — Handlebars email template system
• Notification Connection Modes — Multi-channel delivery (email, push, in-app)