All email from Hatch is sent from hatch.team or its subdomains, so whitelisting *.hatch.team covers everything.
Specifically:
Sign-in codes: clkmail.hatch.team
Notifications and product emails: email.hatch.team, notifications.hatch.team, io.hatch.team, hatch.team
