From 6bee9c2f18cf26c29bcd50dd223d972fb0e82e3d Mon Sep 17 00:00:00 2001 From: Adam Date: Fri, 16 Oct 2026 16:43:52 +0000 Subject: [PATCH] Document sign-in email DNS and the new DMARC policy Sign-in codes go out from auth@debate.pi-stack.org through Resend. The subdomain had SPF and DKIM but no DMARC record of its own. A quarantine policy now sits at _dmarc.debate.pi-stack.org in Cloudflare DNS, and this note records which records belong to the sender and how to check them before changing the policy. Co-Authored-By: Claude Opus 5.5 --- docs/operations.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docs/operations.md b/docs/operations.md index 1333c11a8..c5e75b3b6 100644 --- a/docs/operations.md +++ b/docs/operations.md @@ -156,6 +156,16 @@ Before enabling protected browser staging, verify `http://127.0.0.1:18080` for ` Local development origins must remain bounded to intended ports and hosts. +## Sign-in email and DNS + +Production and staging Supabase Auth send sign-in codes from `DebateLab ` through Resend's SMTP relay (`smtp.resend.com`); the relay password lives only in each project's Auth settings. DNS for `pi-stack.org` is the Cloudflare zone. The sending records are: + +- `send.debate.pi-stack.org`: Resend's SPF (`include:amazonses.com`) and bounce MX, so the bounce domain aligns with the From address. +- `resend._domainkey.debate.pi-stack.org`: Resend's DKIM key; messages are signed with `d=debate.pi-stack.org`. +- `_dmarc.debate.pi-stack.org`: `p=quarantine` with relaxed alignment. Reports go to the same Gmail address as `_dmarc.pi-stack.org`; receivers that check external report authorization drop them. + +The SPF and MX records on `debate.pi-stack.org` itself belong to Cloudflare Email Routing for inbound mail. A name can hold only one SPF record, so do not add Resend's there. Before tightening DMARC to `p=reject`, or after changing the sender, send a staging sign-in code to a mail-tester address and confirm `dmarc=pass`, then delete that staging user. Any other service that sends as `@debate.pi-stack.org` must be added to SPF or DKIM first, or its mail lands in spam. + ## Secrets Secret names may be documented; values may not. Server-side categories include: