# Sending Domains, Suppressions & Stale Roles | Changelog

Source: https://wraps.dev/changelog/sending-domains-suppressions-and-stale-roles

![Wraps Logo](https://wraps.dev/wraps-light-logo.png)![Wraps Logo](https://wraps.dev/wraps-dark-logo.png)

](https://wraps.dev/)

[](https://github.com/wraps-team/wraps)[Log in](https://app.wraps.dev/auth?mode=signin)[Sign up](https://app.wraps.dev/auth?mode=signup)

Toggle menu

[← All changes](https://wraps.dev/changelog)

DashboardSeptember 2026

### Sending Domains, Suppressions & Stale Roles

Sending domains, suppressions and role health move from CLI-only into the dashboard.

![Adding notify.acme.dev on the Sending Domains page: it lands as pending verification, and its detail sheet lists the three DKIM CNAME records to publish](https://wraps.dev/email/2026-09-dashboard-domains-clip.gif?dpl=dpl_VehRCjcz7WHYU3nef8UNqcfyh7aq)

-   A sending-domains page lists every SES identity with its verification state and the DKIM CNAMEs and MAIL FROM records still to publish, adds a domain with SES-managed Easy DKIM, and opens a per-identity sheet for the configuration set that governs it: tracking domain, TLS policy, suppression reasons and event destinations — the sheet flags an `OPTIONAL` tracking `HttpsPolicy` and an empty event-destination list, the usual reasons click links break and delivery events never arrive. Onboarding had told customers they could manage domains in the dashboard while the only working paths were installing the CLI or rebuilding the CloudFormation stack
-   The SES suppression list is browsable from the dashboard, and an address can be removed. A `COMPLAINT`\-reason removal re-reads the reason from SES rather than trusting the browser, and refuses without an explicit acknowledgement. The underlying `email.suppression.*` grants now ship on every deployment path — CDK, Pulumi and CloudFormation — but an existing deployment needs `wraps platform update-role` (CLI v3.9.0+), a CDK 0.3.0+/Pulumi 0.4.0+ redeploy, or a CloudFormation stack update before those calls stop returning AccessDenied
-   The account page flags when the console role’s policy is behind the version Wraps expects and links to the IAM-console repair route, and reports AWS’s actual SES production-access verdict instead of discarding it. `wraps email status --json` reports sandbox state and quota and recognizes a CloudFormation deployment instead of exiting 1 with “No email infrastructure found”
-   Fix: a broadcast into an SES account AWS has paused is now blocked at the review step instead of running past the point-of-no-return dialog and failing every recipient — a `PROBATION` account only warns rather than blocking, and a check that cannot read account state never refuses a legitimate send. Fix: the sending-domains list pages through every SES identity instead of showing only the first 100

Also fixed (1)

-   The setup dashboard's "Send a test email" step now links to the sending-domains page instead of sending a test email itself.

Platform v0.28.0