011 — Ownership vs DNS readiness

Context

Turning on receiving (or other settings) can add required DNS records. Demoting verified when those records are incomplete would reopen claim races and conflate "owns the domain" with "mail is fully configured."

Decision

• user_domains.status = verified means ownership (and stays verified when settings add incomplete required records).
• API DomainDetail exposes computed readiness flags (not stored columns):
  • sendingReady — sending enabled and all sending-required DNS keys verified
  • receivingReady — receiving enabled and inbound requirements verified; false when receiving is off

Consequences

• domains.verify on an already-verified owner may update dnsRecords only.
• Clients should use readiness flags for setup UI, not status alone.