Branded replies

Fromenance is a communication provenance platform that replies to customers in your institution’s name, so the reply should come from your domain. This page sets up the branded reply identity and explains the minimal identity used during pilots.

By the end you will have a sending subdomain such as verify.yourdomain.com verified, three DNS records published, and replies arriving from verify@verify.yourdomain.com with a DKIM pass for that subdomain.

Two reply identities

Mode	Reply From	DNS	Use
Branded (recommended)	Northfield Bank <verify@verify.yourdomain.com>	The trust TXT record plus three records on the sending subdomain	Production
Minimal	Northfield Bank <northfield@reply.fromenance.com>	The trust TXT record only	Pilots. The wizard says so and production tenants should not stay on it

reply_mode on the tenant (branded or minimal) selects the identity; reply_from_name sets the display name. The web verify page renders the verdict on the page and needs no reply identity at all.

1. Create the reply identity

In the admin app open Domains, choose the domain, and click Set up reply identity. Or from the API:

curl -X POST https://api.fromenance.com/v1/domains/dom_.../reply-identity \
  -H "Authorization: Bearer fr_live_..." \
  -H "Content-Type: application/json" \
  -d '{"subdomain":"verify"}'

subdomain is optional and defaults to verify, giving verify.yourdomain.com. Fromenance creates that subdomain as a sending domain through Resend, adds the reply role to your domain, and returns reply_identity.records.

2. Publish the three records

The exact values come back in the response and are shown in the admin app; the shape is:

Record	Name	Type	Value
DKIM	resend._domainkey.verify.yourdomain.com	TXT	p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC...
SPF (return path)	send.verify.yourdomain.com	MX, priority 10	feedback-smtp.us-east-1.amazonses.com
SPF	send.verify.yourdomain.com	TXT	v=spf1 include:amazonses.com ~all

Together with the trust TXT record this is four records total. Nothing on your apex or your main sending domain changes, and your existing DMARC policy applies: replies are DKIM aligned with verify.yourdomain.com, which is a subdomain of your organizational domain, so p=reject with relaxed alignment passes. If you use strict DKIM alignment (adkim=s) add an explicit _dmarc.verify.yourdomain.com record.

3. Verify the records

Click Verify in the admin app or call:

curl -X POST https://api.fromenance.com/v1/domains/dom_.../reply-identity/verify \
  -H "Authorization: Bearer fr_live_..."

reply_identity.status moves to verified once Resend sees all three records; each record also carries its own status. Then set reply_mode to branded and reply_domain_id to this domain:

curl -X PATCH https://api.fromenance.com/v1/tenant \
  -H "Authorization: Bearer fr_live_..." \
  -H "Content-Type: application/json" \
  -d '{"reply_mode":"branded","reply_domain_id":"dom_...","reply_from_name":"Northfield Bank"}'

4. Send a test reply

Reply templates, choose any outcome, Send test (POST /v1/reply-templates/{outcome}/test) mails the rendered template to your own address from the reply identity. Confirm the message shows verify@verify.yourdomain.com as the sender and passes DKIM in your client’s authentication details.

Notes

• Replies are only ever sent to the customer who forwarded the message, from the identity above, and never quote the forwarded message or its links.
• Sandbox submissions (test keys, sandbox tenants) never mail a customer; the reply goes to the fraud contact address in Settings when it is an email address.
• The reply subdomain is only used for verdict replies. Do not point application mail at it.