From e893960a85b415d2a970db13bcd688b3ab5852ea Mon Sep 17 00:00:00 2001
From: Dries Augustyns <inbox@driaug.com>
Date: Mon, 1 Dec 2025 15:27:28 +0100
Subject: [PATCH] Verify email domain before sending emails

---
 apps/api/src/services/CampaignService.ts | 4 ++++
 apps/api/src/services/EmailService.ts    | 5 +++++
 2 files changed, 9 insertions(+)

diff --git a/apps/api/src/services/CampaignService.ts b/apps/api/src/services/CampaignService.ts
index f5df641..964dcda 100644
--- a/apps/api/src/services/CampaignService.ts
+++ b/apps/api/src/services/CampaignService.ts
@@ -5,6 +5,7 @@ import {prisma} from '../database/prisma.js';
 import {HttpException} from '../exceptions/index.js';
 import {buildEmailFieldsUpdate} from '../utils/modelUpdate.js';
 
+import {DomainService} from './DomainService.js';
 import {EmailService} from './EmailService.js';
 import {QueueService} from './QueueService.js';
 import {type SegmentFilter, SegmentService} from './SegmentService.js';
@@ -650,6 +651,9 @@ export class CampaignService {
       throw new HttpException(403, 'Test emails can only be sent to project members');
     }
 
+    // Verify domain is registered and verified before sending
+    await DomainService.verifyEmailDomain(campaign.from, projectId);
+
     // Get project to validate from address
     const project = await prisma.project.findUnique({
       where: {id: projectId},
diff --git a/apps/api/src/services/EmailService.ts b/apps/api/src/services/EmailService.ts
index 58d384b..3253503 100644
--- a/apps/api/src/services/EmailService.ts
+++ b/apps/api/src/services/EmailService.ts
@@ -7,6 +7,7 @@ import {prisma} from '../database/prisma.js';
 import {HttpException} from '../exceptions/index.js';
 
 import {BillingLimitService} from './BillingLimitService.js';
+import {DomainService} from './DomainService.js';
 import {QueueService} from './QueueService.js';
 import {sendRawEmail} from './SESService.js';
 
@@ -310,6 +311,10 @@ export class EmailService {
     }
 
     try {
+      // Verify domain is registered and verified before sending
+      // This ensures all emails (transactional, campaign, workflow) use verified domains
+      await DomainService.verifyEmailDomain(email.from, email.projectId);
+
       // Update status to sending
       await prisma.email.update({
         where: {id: emailId},