Plan the address as an operational dependency
This guide covers a custom organizational From address in Granicus govDelivery. It does not assume that a display-name edit creates a new authenticated sending domain. Record the account, intended sending subdomain, bulletin templates and topic restrictions. Include the communications owner, Account Administrator and DNS administrator in the change.
Granicus requires support involvement to add a new unique From address. Its documented request includes the desired address, display names, topic restrictions and administrator approval where applicable. Existing template defaults can select an address independently of the account default, so include template selection in your rollout plan. From-address management
Obtain the deployment-specific DNS instructions
Use the approved subdomain and the regional records supplied for your account. The provider's custom-domain workflow calls for SPF, MX, DKIM CNAMEs and DMARC before activation. Granicus supplies six DKIM CNAMEs and confirms their installation before enabling signing. Do not copy a regional SPF example into an account in another region, and do not substitute a root-domain mailbox migration for the dedicated sending subdomain. Custom-domain requirements
Create a change worksheet with every full owner name, type, value, existing answer and accountable person. Preserve the original values for rollback. A DNS provider may append the zone to short owner names, so check the resulting fully qualified name rather than relying on the editor's appearance. Keep CNAME owners free of incompatible data and preserve one SPF policy at the applicable owner. Evaluate the complete SPF lookup budget, including nested includes.
Review DMARC with the domain owner. Avoid copying legacy reporting or percentage tags simply because they appear in a sample. Confirm the intended policy scope and reporting destination using the current DMARC specification. DKIM is a signature verified using a public key, not message encryption; SPF and DKIM records being present is not the same as successful aligned authentication.
Check activation and template selection separately
Original release procedure: retain the support confirmation that the domain is ready, then inspect the account and relevant template From choices. Send a harmless bulletin to controlled recipients from each materially different template or permitted address. Do not send a public alert as an authentication test.
Capture the receiver-added authentication results, visible From domain, SMTP envelope domain, DKIM d= and s= values and the selected template identity. A DMARC pass needs a passing SPF or DKIM identity aligned with the visible From domain. The provider's ready status and an SMTP delivery event are useful but do not prove that every template uses the approved address.
Illustrative failure: support activates a new subdomain, but a recurring bulletin template still chooses an older From address. Replacing the new domain's key will not change that template. Correct the selection through the authorized account workflow, then retest that bulletin path.
Keep a recoverable communications route
If the new identity fails, pause its planned bulletin and use an already approved route only with the communications owner's agreement. Do not invent a new emergency sender or weaken domain-wide policy to meet a publication deadline. Ask support to investigate the exact account, affected From address, DNS answers and receiver results. Preserve earlier valid selectors while cached or queued mail may still depend on them.
Recheck after template changes, domain moves, regional migrations or support-led key changes. This guide is based on first-party documentation reviewed on 8 November 2026; no govDelivery account, bulletin, live DNS or delivery outcome was exercised. The release procedure is an original proposed control.
Separate the support and communications handoffs
The DNS owner records the approved regional values and their authoritative answers. Support confirms provider activation. The communications owner records which template and address were selected. Join those three references to the same controlled bulletin identifier. If one is missing, leave the acceptance row incomplete. A public alert deadline does not justify turning an unverified test into production traffic.