How do you customize From-domain match?

Configuring `allowedFromDomains` is not really an override, it is the act that switches this check on — the value is always yours. Set it to every domain and subdomain you legitimately send from, including the ones your ESP, CRM and support tooling use, and including delegated subdomains you have given to agencies. The narrower the list you can honestly keep, the more the check is worth: a list containing every domain anyone has ever used cannot detect anything.

There is no useful Standard state to stay on here, because the unconfigured default is a skip rather than a verdict. The nearest equivalent decision is whether to run this check at all: if you cannot yet enumerate your sending domains, leave it out of the set until you can, rather than listing everything to make it pass. If you are auditing mail on someone else's behalf and do not know their sending estate, ask them for the list rather than inferring it from the sends you happen to see.

Every domain you add is a domain the check will never question again, so a permissive list buys quiet at the cost of the whole point. Keeping it tight has the opposite cost: a legitimate new tool will fail its first send until someone updates the list, which is friction you have to be willing to own. The list also has to be maintained — a stale list fails good mail after a platform migration, and the temptation in that moment is to widen it rather than correct it.

There is no community default here and there could not be one: your sending domains are facts about your organisation, not a standard anyone else can publish. The list should therefore be owned where domain and authentication records are owned, not where campaigns are built, and it should be updated as part of onboarding a new sending platform rather than after the first failed send. Record why each domain is on the list, because an entry nobody can account for is usually a tool somebody has forgotten is still sending.

A company sending marketing from its ESP and receipts from its application sets `allowedFromDomains` to both the marketing subdomain and the transactional one, and nothing else, so a new tool sending from a shared platform domain fails immediately. A brand that has delegated a subdomain to its agency lists that subdomain explicitly, which keeps the agency's mail passing while still failing anything sent from the agency's own domain. A group with several trading names lists each brand's sending domain rather than adding a wildcard, accepting the maintenance so that a send from a retired brand still surfaces.