AI-written, grammatically correct.
Latch
DNS automation for SaaS onboarding, deployed at latch.gbuild.app. Built because every product in the category assumes a human is present at the registrar login.
Connecting a custom domain is the most common drop-off point in SaaS onboarding, and there is a good category of products that solve it. They all solve it the same way: an embedded modal walks a person through logging into their registrar, and the records get written for them. That flow has a human in it by design.
The system this was built for does not have that human available at that moment. An agent standing up a mailbox on a user's own domain needs the DNS write to be a callable operation with an honest return value, not a modal waiting for a click. So Latch does three things: detect where a domain's DNS actually lives, write the records where it holds credentials, and verify propagation from outside against multiple resolvers rather than trusting the write it just made.
The engineering that took the time was email DNS, not DNS. A domain may hold exactly one SPF record, so the new include gets merged into the existing one and the original all qualifier is preserved rather than helpfully tightened. At SPF's ten-lookup ceiling it refuses instead of flattening includes into literal IPs, because flattening works today and rots silently the moment a provider changes address. Any existing MX is a hard stop, since quietly repointing mail takes down someone's inbox with no error anywhere. Apex CNAME is refused outright, because RFC 1034 does not allow it.
Four days, 15 commits, 270 test cases over a zero-dependency engine that runs identically in tests and on Workers. Two of those commits exist only to make earlier claims weaker: one demoting a verification status that reported "published" when it could only prove "confirmed" for zones we do not control, and one recording an auth gap found by running the real binary on a real machine, written down before it was fixed.
It is deployed and single-tenant. The desktop client that consumes it still points at the service directly, so the bring-your-own-domain flow is not functional in the field until the next sidecar release carries the gateway transport. Reading DNS state is an agent tool; writing it is not, and stays on the human plane until the consent model around outward writes is finished.