Why Wildcard DNS Falls Short for Email Authentication in Multi-Tenant Onboarding

A technical analysis published on DEV Community warns that media publishers onboarding custom domains cannot rely on wildcard DNS entries to confirm mail authentication readiness. While wildcards efficiently handle web routing, they fail to verify that individual customer domains have properly configured SPF, DKIM, and DMARC records, which operate on distinct lifecycles. The article argues that each tenant domain requires its own discrete verification state, preventing a single passing DNS lookup from masking incomplete email policy setup. To manage propagation delays and partial configurations, the author recommends a five-stage state machine — requested, observed, verified, active, and drifted — that tracks evidence per record rather than per customer as a whole. This approach ensures each domain cutover is independently auditable and can be rolled back without affecting other tenants.