# Trust the senders you rely on

> Mark a vendor's domain, or one exact address, as trusted. Mail it genuinely signs is labeled Trusted and reaches your agents in full, never quarantined.

- Date: 2026-11-11
- Tags: Trust, Dashboard, API
- Video: https://machinemail.dev/changelog/media/trusted-domains.mp4 (A simplified MachineMail dashboard. An invoice from invoices@vendor.example is marked Quarantined in the threads list. The sidebar moves to Trusted domains, where vendor.example is added with a shield icon. Back in the threads list, the same invoice is now marked Trusted. It ends on the MachineMail logo.)
- Source: https://machinemail.dev/changelog/trusted-domains

The trust layer is careful with senders it has no history with, so now and then mail you were waiting for, such as an invoice from a new vendor, is held for review. You can now tell MachineMail who you work with. Add a domain or one exact address under **Trusted domains** in the sidebar, and mail it genuinely signs is labeled `TRUSTED` and handed to your agents in full.

- **Signed mail only.** Trust applies when the message carries the trusted domain's own DKIM signature. A spoofed From address is judged as usual.
- **A check before you add.** The dialog says whether we have seen signed mail from the domain, whether it looks like a domain you already trust, and how many held messages it would release.
- **Release what was held.** Adding an entry can release matching mail from the last 30 days. Remove the entry and that mail goes back to its ordinary verdict.
- **One address is enough.** Free mail providers can't be trusted as a whole, but one exact address at one can. Suggestions list the senders you already correspond with.
- **Blocks still win.** A block entry or an allow-only inbox still stops the mail. Malware is still withheld, and instructions aimed at agents are still flagged.
- **People decide, not agents.** Only an organization API key or a person in the dashboard can add an entry, so an email can't talk an agent into trusting its sender.

Free organizations can trust 10 domains or addresses, paid plans 500, at the organization, a pod or a single inbox. It is in the API and the CLI too.

Read more: [Trusted domains](https://machinemail.dev/docs/concepts/trusted-domains).