When MailChannels rolled out Domain Lockdown on June 20th, we exempted Workers users who had already sent emails through our API to give them time to implement the new domain verification feature. Later this week, we will begin enforcing Domain Lockdown on these legacy users.
Here’s how to become compliant with Domain Lockdown in three steps:
- Find the
CF-Workerheader associated with your Worker, a header that identifies the zone in which your Worker lives. This header is included in everyfetch()request by Cloudflare, and it’s how MailChannels identifies you to establish your reputation and track any abusive email you send. If you need help finding this value, send aGETfetch()from your worker to https://postman-echo.com/get, and it will return JSON containing your request headers like this:
export default {
async fetch(request, env, ctx) {
const url = "postman-echo.com/";
async function gatherResponse(response) {
const { headers } = response;
const contentType = headers.get("content-type") || "";
if (contentType.includes("application/json")) {
return JSON.stringify(await response.json());
}
return response.text();
}
const init = {
headers: {
"content-type": "application/json;charset=UTF-8",
},
};
const response = await fetch(url, init);
const results = await gatherResponse(response);
return new Response(results, init);
},
};
This will return something like the following:
{
"args": {},
"headers": {
...
"cf-worker": "myzone.workers.dev",
"accept": "*/*"
},
"url": "https://postman-echo.com/get"
}
Look for the cf-worker line in the JSON response. The value of that key is your CF-Worker id. Keep in mind that the CF-Worker header does not identify the subdomain serving your Worker; rather, it’s the zone. In most cases, this means your domain name or your workers.dev string, which can be found on the dashboard for Workers.
- Create a Domain Lockdown record for each domain from which you want to send email. These TXT records specify your
CF-Workeridentity, telling MailChannels that you authorize thatCF-Workerto send email from the domain. Following thefetch()code from above, if your domain isexample.comand yourCF-Workerid ismyzone.workers.dev, then you would need to add a TXT record like this:
_mailchannels.example.com TXT "v=mc1 cfid=myzone.workers.dev
If you send out of multiple domains, each one will need its own _mailchannels record. Subdomains will also each need their own record.
- If for some reason we can’t find the TXT record or if your
cfidfield is wrong, you will get an error message from our API such as the following:
5.7.1 This sender is not authorized to send from mailchannels.com. See https://bit.ly/domain-lockdown. cfid=example.workers.dev
As you can see, our rejection error message gives you the cfid value to include in your Domain Lockdown record.
For further assistance, please reply here or contact our support team.
