AI-Generated Code Silently Used Wrong Domains in Production Emails for Months

A developer discovered six incorrect domain names embedded in production server functions, all introduced by AI-generated code that had gone undetected for months. The errors affected contact forms, security alert emails, and password reset messages, with some emails failing silently at the transactional email provider because the sending domains were never verified. Standard development tooling — type checkers, bundlers, test suites, and deployment pipelines — flagged none of the issues, as these tools validate code structure rather than whether referenced domains are actually owned by the organisation. The root cause was that AI models tend to generate the most statistically plausible value, such as a brand's .com address, which looks correct in code review unless the reviewer already knows the right answer. The developer resolved the issue in roughly twenty minutes by extracting all URL hosts and email domains from the codebase and comparing them against a declared list of owned domains.