Decide which Greenhouse route you are changing
The catalogue name GreenHouse covers products whose mail does not necessarily follow the same route. This guide's main procedure is Greenhouse Recruiting domain verification. Record the actual feature, intended From domain, sending account and whether a custom SMTP route is configured. Obtain the DNS administrator's involvement before making changes affecting a shared corporate domain.
For Recruiting, authorized users register the domain under Configure > Dev Center > Email Settings and obtain the generated records. Greenhouse's standard setup uses a gh-mail subdomain. Sourcing Automation's email-security instructions instead direct you to your mailbox provider for SPF and DKIM. Do not treat successful Recruiting verification as evidence that a connected Google or Microsoft mailbox is configured correctly. Recruiting setup · Sourcing Automation security
Choose the domain form deliberately
Check the domain's DMARC alignment settings before registration. Greenhouse documents a no-gh-mail registration option using an exclamation mark before the domain for strict-alignment situations. That option changes the generated DNS scope and requires deliberate migration if an entry already exists. It is not a reason to weaken an organization's DMARC policy. Registration and strict-alignment option
Compare generated owners and values with existing records before publication. Preserve the complete SPF authorization inventory and one policy per owner. Keep CNAME records free of conflicting data. Do not redirect root-domain receiving mail merely because an MX record is requested for a dedicated sending subdomain. If the console and planned DNS scope disagree, stop and clarify rather than transplanting subdomain values to the apex.
For long DKIM values, first use the DNS host's supported TXT-string handling. A TXT record can contain multiple character strings; a limit on one string does not automatically require a weaker key. Do not truncate the public key. Ask the provider for help if its generated format cannot be represented correctly by your DNS service.
Verify the registered domain and the actual message
Use Check DNS Records Now in Email Settings. Greenhouse describes check marks as the verified state and ellipses as pending verification. Keep the resulting status with the exact record set and timestamp. Verification FAQ
Original acceptance design: prepare separate rows for a candidate email, any enabled notification route in scope and a Sourcing Automation message if that product is used. Send only harmless controlled messages. Record the actual route, visible From domain, envelope sender, DKIM d= and s= values, and trusted receiver-added authentication results. DMARC requires at least one passing aligned authentication method; a signature from an unrelated domain is insufficient by itself.
Illustrative scenario: Recruiting shows verified, yet a sourcing campaign fails DKIM because it uses the recruiter's connected mailbox. Editing Recruiting's gh-mail selector will not repair that mailbox. Compare the product and route first, then assign the correction to the right mail administrator.
Maintain a reversible change
Pause the affected sending workflow if the new identity fails, leaving unrelated recruiting operations intact where possible. Preserve original registration details before removing an entry for a supported migration. Restore the last approved configuration only after considering queued messages and DNS caching. Retest every route whose domain or transport changed.
This guide reflects provider documentation reviewed on 8 November 2026. No Greenhouse tenant, candidate data, DNS record or sent message was accessed. The route matrix and scenario are original proposed tests, not evidence of a completed deployment.
Distinguish strict alignment from enforcement level
Written case GH-01 assumes From recruiter@example.com, SPF pass for gh-mail.example.com, and DKIM pass with d=gh-mail.example.com and s=mail1. Under strict aspf=s and adkim=s, neither assumed identity exactly matches example.com, so neither supplies alignment. Under relaxed modes those subdomain identities can align. A p=reject value alone does not select strict alignment. Before changing registration, the recruiting owner and DNS administrator must confirm the real identities and modes, preserve existing records and agree a migration plan. The exclamation-mark registration option is provider-specific; it is not a DNS label. No candidate message, domain registration or DNS lookup occurred.
Preserve the enforcement boundary
RFC 9989 Section 7.4 requires valid DKIM, not SPF alone, for domains publishing p=reject, and warns about indirect-mail and mailing-list interoperability. A single successful direct-message test is not proof that every legitimate route is ready for stronger policy. Keep existing approved protection while diagnosing the actual gap; any policy change needs its own decision.