When should you use Sent from your own domain?
email-from-domain-match · functional · recommended
When should you use this check?
Run this on every commercial send once you have declared your sending domains, because the failure it catches is silent and expensive. It matters most when more than one system can send on your behalf — a marketing platform, a CRM, a support desk, an agency's tool — since that is how mail starts arriving from a domain nobody signed off. Keep it in the standard set for cold outreach in particular, where an unfamiliar sending domain is the difference between a reply and a spam report.
When should you not?
Skip it while you genuinely do not know your own approved list, because until it is configured the check cannot run and will simply report as needing configuration. It is also not the right tool for verifying authentication: it reads which domain the mail claims to come from, not whether SPF, DKIM or DMARC pass for it. If your question is whether your alignment records are correct, that is a DNS and authentication review, and this check complements it rather than replacing it.
What does it inspect?
Parse From: header; extract domain. Fail if domain is not in allowedFromDomains parameter list (case-insensitive). Error if From: header is absent.
What does a failure mean?
A failure means the mail arrived from a domain that is not on your approved list, and it names the domain it found. To a recipient that reads as a possible spoof, and to a mailbox provider it reads as a reason to treat your mail with more suspicion — the cost is paid in deliverability, quietly, over subsequent sends. The most common cause is not an attack but a tool: a platform defaulting to its own shared domain, or a subdomain introduced by a new integration.
What are the Standard defaults — and why?
One parameter carries the check: `allowedFromDomains`, whose Standard default is an empty list at `required` severity. That is a deliberate gate rather than an oversight — there is no universal set of correct sending domains, because every brand's are its own, so instead of guessing the check reports as needing configuration until you state yours. The empty default is what keeps it from erroring on every unconfigured job, since an error scores as a failure at any severity.
How does an agent call it?
{
"type": "email",
"validations": [
"email-from-domain-match"
]
}
Who governs the Standard?
Schemafirst.org publishes community-governed standards for digital QA. ArbiterQA is a sponsor and commercial licensee of those standards; citation does not mean Schemafirst operates ArbiterQA.
Author ArbiterQA · Reviewed by ArbiterQA · 2026-08-14