Manual DNS editing is where SaaS onboarding goes to die. Latch detects where a domain's DNS actually lives, writes the records for it where it can, and verifies propagation server-side — so your users go from domain to done without ever leaving your app.
One engine — detect · connect · verify — served as an HTTP API, an embeddable SDK, and MCP agent tools.
Copy a value into the wrong panel and email silently fails — often weeks later, with no signal tying the outage back to the record. These are the four failures Latch's engine is built to prevent, each one a required behavior and a unit test.
Publishing a second v=spf1 TXT is a permerror — every message fails. Latch parses the existing record and merges into one, preserving your all qualifier and counting terms against the 10-lookup ceiling.
A p= value longer than 255 bytes must split into multiple quoted strings inside one TXT record — two records at one selector is broken DKIM. Latch also honors the provider's CNAME-vs-TXT choice instead of guessing.
Any existing MX means a live mail provider. Latch emits an existing_mx warning and hard-stops for explicit confirmation — it never silently overwrites the records that route someone's mail.
A literal CNAME at the apex violates RFC 1034 and breaks SOA/NS/MX coexistence. Latch uses ALIAS/flattening where the host supports it, else A/AAAA — and any flatten is additive, never dropping coexisting records.
The whole product is one portable engine with zero runtime dependencies — it runs the same in a Cloudflare Worker and in Node. Everything else is a thin skin over these three calls.
Latch maps on the authoritative nameserver suffix — not WHOIS or the registrar, because the registrar is rarely the DNS host.
Order: live NS → SOA MNAME → WHOIS fallback. Flags DNSSEC, parked, unregistered, and not-delegated up front.
Where Latch can write, it does. Where it needs consent it opens OAuth in the system browser; where it can't, it hands off a polished manual flow.
SPF merges, DMARC defaults to p=none, existing MX is never clobbered. Email intelligence is baked into every write.
Two-tier truth so "done" actually means done: Published is the real success gate; Propagating means public resolvers are still catching up.
Polls 10s → backoff → 72h, and never pre-queries a name before writing (that would poison the negative cache).
The universal guarantee is the manual fallback — a polished, copy-ready flow that works for every domain on earth. Automated writes are rolling out provider by provider, and we tell you exactly where each one stands.
Latch is single-tenant today and the automated adapters are staging in one at a time. What that means in practice: some domains get one-click writes now, and the rest get a manual flow so polished it still feels like one — with server-side verification either way.
The same detect / connect / verify engine is exposed as agent tools and an MCP server — so a domain can be connected in conversation, safely.
An MCP server exposes latch_detect, latch_connect, latch_verify, and latch_providers_health as tools — thin clients over the same Worker your SDK talks to.
The safe form of "agent-derived adapters": a provider's write API described as an interpreted manifest — data, never generated code or eval. DELETE is unreachable by design.
Trust is a caller-supplied option, never a field a manifest can set for itself. Without granted trust, apply() refuses to write and dryRun() renders the would-be requests for a human to review first.
Domain-connect tooling has been an enterprise line item. It shouldn't be — the guided manual flow works for every domain, so it's free.
Everything a small team needs to stop losing users at the DNS step.
@gbuild/latch embeddable SDKAutomated writes and agent tooling, rolling out provider by provider.
Multi-tenant Latch for platforms embedding it for their own customers.
Straight talk: Latch is single-tenant today, so Pro and Scale are on the roadmap rather than self-serve. The Free tier — detect, verify, the SDK, and the manual fallback — is real and shipping. We list what's coming so you can plan, not to sell you vapor.
Mint a token, drop in the SDK, and call detect. The quickstart has the exact request shapes and record types.