Repository navigation
feat(edge): manage the SES DKIM records and publish DMARC - #57
Merged
Merged
Conversation
ONE published three DKIM CNAMEs for mail sent through its Amazon SES account as studio@developmentfinance.org. Import adopts them, unproxied, so a plan shows if one changes. A new _dmarc TXT record publishes v=DMARC1; p=none.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prepares the sending domain for the website's email sign-in (#48). ONE's infrastructure team published three DKIM CNAMEs in the
developmentfinance.orgzone for mail that its Amazon SES account sends asstudio@developmentfinance.org.infra/stacks/edge/cloudflare_dns.tfadopts them withimportblocks keyed by DKIM token, unproxied and with their content unchanged, so a plan shows if anyone proxies or edits one. SES can only read the signing keys through DNS-only records, and the domain loses its verified status without them. AWS rotates the keys behind the names, so the records never change.A new
_dmarcTXT record publishesv=DMARC1; p=none. Receivers apply no policy, and the record names no report mailbox, so nobody receives aggregate reports until aruatag is added. Gmail and Yahoo expect a sending domain to publish DMARC. Mail passes it through the aligned DKIM signature, since SES sends from its own MAIL FROM domain and SPF aligns with that.Testing:
terraform fmt -checkpasses. Aterraform plan -lock=falseofinfra/dfo-prod/edgewith the plan token shows 3 to import, 1 to add and 3 to change. Each change adds only theManaged by Terraformcomment to an imported DKIM record. Not applied.