Bound, verified, enforced: three states people read as one

A key's relationship to a domain has three separate properties. People read them as one, and that is entirely our fault for not naming them clearly enough for long enough.

Bound. The key names a domain. Somebody typed it in. This is a claim.

Verified. Control of that domain has been demonstrated, by a TXT record or a file, and re-demonstrated recently enough that we still believe it. This is a fact.

Enforced. Refusal actually happens when the domain does not match or is not verified. This is whether either of the above does anything.

Why the third one is separate

Historically, enforcement was off by default.

That was right at the time. Shipping the feature with enforcement on would have cut off every existing customer who had never been asked to verify anything — a migration by outage, which is not a migration.

It was also wrong to leave standing. With enforcement off, a verified domain and an unverified one mean the same thing at request time. Proving ownership achieves nothing. Losing it costs nothing. The lock is decoration.

So enforcement is on now, decided once and recorded so it cannot silently flip back, and turning it off is a deliberate act with a warning attached.

Reading your own dashboard

• Domain, green badge. All three hold. Nothing to do.
• Domain, amber warning. Bound and not verified. Either you have not proved it yet, or the proof lapsed — and calls are being refused right now.
• No domain. A server key, or a client key that is not protected by anything. Check which you meant.

The re-check is forgiving, not optional

We allow several failures before anything changes, because DNS is DNS and one bad lookup means nothing.

What we do not do is treat a proof from a year ago as current. "Verified" means *last time we could see it*, and a proof nobody has been able to see for a month has lapsed whether or not a background job happened to notice.

That is the part worth internalising if you are debugging a key that worked last quarter: nothing changed at your end, and that is exactly the problem.