[Programcode]

DebateLab sends sign-in codes from auth@debate.pi-stack.org through Resend, in both production and staging. The subdomain already had Resend's SPF and DKIM records but no DMARC record of its own, so it fell back to the parent pi-stack.org record, which only monitors (p=none).

Change outside the repo (already live): a new Cloudflare DNS record, _dmarc.debate.pi-stack.org TXT "v=DMARC1; p=quarantine; adkim=r; aspf=r; rua=mailto:…". Nothing else in DNS changed.

Change in the repo: a short "Sign-in email and DNS" section in docs/operations.md covering the sender, the three records, and how to check them before tightening the policy.

Proof

Each check below used a real staging sign-in email sent to mail-tester.com. The three throwaway staging users were deleted afterwards.

• Before the record: SPF pass on send.debate.pi-stack.org, DKIM pass with d=debate.pi-stack.org, dmarc=none (p=none).
• After the record: dmarc=pass (p=quarantine dis=none) header.from=debate.pi-stack.org. Score 9.6/10, "You're properly authenticated".
• dig TXT _dmarc.debate.pi-stack.org returns the new record from Cloudflare's nameservers and from 8.8.8.8.
• npm run docs:check passes.

Notes

• DKIM was already on at Resend: the domain's key is published and messages are signed. It uses a 1024-bit key, which is Resend's default.
• Gmail doesn't authorize outside domains to send it DMARC reports, so many receivers will drop reports sent to that address. This is the same address the parent record uses.
• _dmarc.pi-stack.org (personal iCloud mail, p=none) was left alone.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
debate-navigator	Ready	Preview	Oct 16, 2026 4:45pm UTC
debatelab-staging	Ready	Preview	Oct 16, 2026 4:45pm UTC

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Warning

Review limit reached

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Next included review available in 29 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Free
• Run ID: 2dba8699-d9ab-4ea6-b474-1f46c11fe4b5

📥 Commits

Reviewing files that changed from the base of the PR and between 3f4f22f and 6bee9c2.

📒 Files selected for processing: 1

• docs/operations.md

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Essentials by visiting https://app.coderabbit.ai/settings/billing.

_{Comment @coderabbitai help to get the list of available commands.}

[Programcode]

The docs job failed after 2 seconds with no steps or logs. That's the GitHub Actions minutes limit, not this change. CodeRabbit also skipped this PR because its review limit is reached.

Local results at head 6bee9c2f (a local pass, not a CI pass):

• npm run docs:check: pass
• npm run verify: pass, including the desktop Chromium @smoke run (30/30)

This change only touches docs, so the database gate doesn't apply.