diff --git a/.obsidian/workspace.json b/.obsidian/workspace.json index bddfcb5..4d866f1 100644 --- a/.obsidian/workspace.json +++ b/.obsidian/workspace.json @@ -212,6 +212,7 @@ }, "active": "7066c9273c6fb936", "lastOpenFiles": [ + "010 inbox/Email & DNS Setup — Domains, Mailboxes & Records.md", "010 inbox/Central AI Hub.md", "010 inbox/Family Holiday Camping Wilsons Prom.md", "400 Personal Family/470 Holidays Travel/Family Holiday Camping Wilsons Prom.md", @@ -239,7 +240,6 @@ "200 projects/260 Ideas to Build Create Make/Artemis on GrapheneOS Pixel Mobile.md", "400 Personal Family/460 Family Archive/Wilsons Prom Camp.md", "010 inbox/Obsidian Sorter.md", - "300 areas/360 Dev-Ops Network Computers/Obsidian Sorter.md", "010 inbox/_WATCHER", "300 areas/355 AI Research and Techniques", "300 areas/355 Ai Research and Techniques", diff --git a/010 inbox/Email & DNS Setup — Domains, Mailboxes & Records.md b/010 inbox/Email & DNS Setup — Domains, Mailboxes & Records.md new file mode 100644 index 0000000..30f44fc --- /dev/null +++ b/010 inbox/Email & DNS Setup — Domains, Mailboxes & Records.md @@ -0,0 +1,185 @@ +--- +type: note +proposed_folder: 300 areas/360 Dev-Ops Network Computers +proposed_toc: "100 Table of Contents/Areas.md → Dev-Ops & Network Computers" +proposed_tags: + - email + - domains + - mailboxes + - records + - dns + - cloudflare + - ses + - purelymail + - reference +confidence: 0.49 +approved: false +proposed_for: e5343c33a7a3 +created: "2026-10-11 14:59" +tags: + - email + - dns + - cloudflare + - ses + - purelymail + - reference +aliases: + - email-setup + - dns-and-email-reference +modified: "2026-10-11 14:59" +--- + +# [[Email & DNS Setup — Domains, Mailboxes & Records]] + +> **Single reference for how email + DNS works across all domains.** Written 2026-10-11. +> Verify any record with: `host -t MX ` / `host -t TXT `. +> Secrets are **not** in Obsidian — see "Credentials" below. + +--- + +## 1. Architecture (three layers) + +Email is split so each concern uses the right tool — **mailboxes** and **sending** are deliberately separate (reputation isolation): + +``` +INBOUND → Cloudflare DNS (MX) → PurelyMail (mailboxes) → forward → Gmail +OUTBOUND → Amazon SES (verified, SPF+DKIM signed) ← websites / apps +DNS → Cloudflare (authoritative for all domains; also holds site A records) +``` + +| Layer | Provider | Cost | Role | +|---|---|---|---| +| **DNS** | **Cloudflare** (authoritative NS) | $0 | All DNS: A, MX, SPF, DKIM, DMARC | +| **Inbound mailboxes** | **PurelyMail** (`mailserver.purelymail.com`) | ~US$10/yr flat, **unlimited domains** | Real domain mailboxes + forwarding | +| **Reading mail** | **Gmail** (`samuelrolfe@gmail.com`) | $0 | PurelyMail forwards everything into Gmail | +| **Outbound (websites)** | **Amazon SES** (ap-southeast-2) | ~$0 at low volume | Transactional sending, DKIM-signed | + +**Why this shape:** inbound uses PurelyMail (managed, so no residential-IP blacklist risk), outbound uses SES (deliverability + reputation isolation from the inbox). Neither uses a local home IP for mail. + +--- + +## 2. Domains + +| Domain | Registrar | DNS (NS) | Site hosted | Status | +|---|---|---|---|---| +| **audasmedia.com.au** | Squarespace/CrazyDomains | Cloudflare (`jo`/`osmar`) | CMS sites still on **InMotion** (origin `173.231.229.92`), proxied via Cloudflare | Email ✅ live; site migration pending | +| **where-woof.com** | Squarespace/CrazyDomains | Cloudflare (`dane`/`barbara`) | **.13** (behind Caddy .35 → `.13:3020`), A → `144.6.86.11` | Live ✅ | +| **kontra.day** | **Cloudflare** (registered here) | Cloudflare (`barbara`/`dane`) | **.13** (planned) | Being built (Go + htmx); email + A records not yet added | +| ~~kontra.news~~ | — | — | — | ❌ **Expired** — never delegated at registry; replaced by kontra.day | + +--- + +## 3. Email accounts / mailboxes + +| Address | Provider | Delivers to | Purpose | +|---|---|---|---| +| `sam@audasmedia.com.au` | PurelyMail | forwards → `samuelrolfe@gmail.com` | Primary personal/domain address | +| `hello@where-woof.com` | PurelyMail | forwards → `samuelrolfe@gmail.com` | where-woof enquiries | +| `hello@kontra.day` | PurelyMail | *planned* → `samuelrolfe@gmail.com` | kontra enquiries | +| *(catch-all)* | PurelyMail | → `samuelrolfe@gmail.com` | Catches any address at the domain | + +**Sending:** Gmail "Send mail as" (via PurelyMail SMTP) for personal replies; **Amazon SES** for websites/apps. + +--- + +## 4. DNS records per domain + +All three use the same Cloudflare pattern. **All mail records are DNS-only (grey cloud).** + +### audasmedia.com.au +| Type | Name | Value | +|---|---|---| +| NS | `@` | `jo.ns.cloudflare.com`, `osmar.ns.cloudflare.com` | +| **MX** | `@` | `10 mailserver.purelymail.com` | +| TXT | `@` | `v=spf1 include:_spf.purelymail.com include:amazonses.com ~all` | +| CNAME | `purelymail1._domainkey` | `key1.dkimroot.purelymail.com` | +| CNAME | `purelymail2._domainkey` | `key2.dkimroot.purelymail.com` | +| CNAME | `purelymail3._domainkey` | `key3.dkimroot.purelymail.com` | +| CNAME | `_dmarc` | `dmarcroot.purelymail.com` | +| CNAME | `autoconfig` | `autoconfig.purelymail.com` | +| SRV | `_autodiscover._tcp` | `autodiscover.purelymail.com` (0 0 443) | +| A | `@` | `173.231.229.92` (InMotion origin, **Cloudflare-proxied**) | + +### where-woof.com +| Type | Name | Value | +|---|---|---| +| NS | `@` | `dane.ns.cloudflare.com`, `barbara.ns.cloudflare.com` | +| **MX** | `@` | `10 mailserver.purelymail.com` | +| TXT | `@` | `v=spf1 include:_spf.purelymail.com include:amazonses.com ~all` | +| TXT | `@` | `purelymail_ownership_proof=...` (PurelyMail verification) | +| CNAME | `purelymail1/2/3._domainkey` | `key1/2/3.dkimroot.purelymail.com` | +| CNAME | `_dmarc` | `dmarcroot.purelymail.com` | +| CNAME | `autoconfig` | `autoconfig.purelymail.com` | +| SRV | `_autodiscover._tcp` | `autodiscover.purelymail.com` | +| A | `@`, `www`, `admin` | `144.6.86.11` (**DNS-only** — home static IP) | + +### kontra.day ⏳ *(not yet configured)* +Planned, identical to where-woof once PurelyMail ownership proof is added: +MX → `mailserver.purelymail.com` · SPF (PurelyMail + SES) · DKIM ×3 · DMARC · ownership TXT · A `@`/`www` → `144.6.86.11` (DNS-only). + +--- + +## 5. Amazon SES (outbound) + +| Item | Detail | +|---|---| +| **Region** | `ap-southeast-2` (Sydney) | +| **Verified identities** | `audasmedia.com.au`, `where-woof.com` | +| **Sending direction** | Websites/apps (transactional only — not marketing) | +| **SMTP endpoint** | `email-smtp.ap-southeast-2.amazonaws.com` port **587** (STARTTLS) | +| **SMTP IAM user** | `ses-smtp-user.20260903-152339` (permission: `ses:SendRawEmail`) | +| **MAIL FROM** | Default (`amazonses.com`) — DMARC still passes via DKIM alignment | +| **Production access** | Requested 2026-09-03 (transactional) — **verify current status in SES console** | +| **Sandbox note** | Until production access is granted, SES only sends to *verified* addresses | + +**Handoff for web builders:** SMTP host/port above; sender = the domain address (e.g. `hello@where-woof.com`); use SES (not PurelyMail SMTP) for site mail. + +--- + +## 6. Websites & domain routing + +| Domain | Served from | Route | +|---|---|---| +| **where-woof.com** (+www, admin.where-woof.com) | `.13` container (`.13:3020`), Postgres `wherewoof-db`, MinIO | Caddy (.35) `reverse_proxy 192.168.20.13:3020` | +| **audasmedia.com.au** + CMS sites | InMotion VPS (`173.231.229.92`) — *to be migrated to .13* | Cloudflare-proxied A → InMotion | +| **kontra.day** | `.13` (planned, Go + htmx) | Caddy route to be added (port TBD, e.g. 3050) | +| `*.lab.audasmedia.com.au` | Home services on `.13`/`.35` | Caddy (.35), wildcard A → `144.6.86.11` | + +**Caddy** on `.35` is the single reverse proxy for all public sites + `.lab` services (basic-auth on private ones). + +--- + +## 7. Credentials (NOT in this note) + +| What | Where | +|---|---| +| AWS keys + SES SMTP creds | `/home/sam/inmotionhosting_S3_email/aws-credentials.local` (600, on .27) and `.13:/home/sam/.aws-credentials.local` | +| Garage admin/metrics tokens | `.13:/home/sam/Docker/Containers/family-home-lab/garage/garage.toml` + `.env` | +| PurelyMail account | PurelyMail dashboard login | +| Cloudflare account | Cloudflare dashboard login | + +> ⚠️ Obsidian is backed up (cloud) — **never put secrets in vault notes.** + +--- + +## 8. Key gotchas + +- **MX must point at PurelyMail** (`mailserver.purelymail.com`), not a local IP — residential IPs get blacklisted for mail. +- **Cloudflare Email Routing and an external provider (PurelyMail) conflict** — Email Routing must be **disabled** on a domain before pointing MX at PurelyMail (MX records are locked while Email Routing is on). +- **SPF must merge providers**: one TXT listing `_spf.purelymail.com` *and* `amazonses.com`. +- **DMARC passes via DKIM** even with default MAIL FROM. +- **Add kontra.day to PurelyMail first** to get its unique ownership proof, then add records in Cloudflare. +- Garage S3 (local object store) is **separate** from AWS S3 offsite — see [[Backup System — Borg, Kopia & Restic]]. + +--- + +## Related notes +- [[Migration Plan — InMotion to Local + AWS Offsite]] +- [[Phase 2 — Email]] +- [[Cloudflare Record Set — audasmedia.com.au]] +- [[audasmedia.com.au — DNS Baseline]] +- [[Backup System — Borg, Kopia & Restic]] +- [[Error Tracking]] + +--- +*Draft — review and move to an area/project once verified.* diff --git a/010 inbox/_sort log.md b/010 inbox/_sort log.md index 7d3f279..3c8a2a0 100644 --- a/010 inbox/_sort log.md +++ b/010 inbox/_sort log.md @@ -20047,3 +20047,12 @@ What the watcher did, newest last. ### 2026-10-10 15:47:05 - **proposed** `Central AI Hub.md` → `200 projects/Tools Software WebUI` (confidence 0.39) - - Low JEV confidence — recommend human confirmation + +### 2026-10-11 14:59:38 +- **proposed** `Email & DNS Setup — Domains, Mailboxes & Records.md` → `300 areas/360 Dev-Ops Network Computers` (confidence 0.49) +- - Low JEV confidence — recommend human confirmation + +### 2026-10-11 14:59:48 +- **re-proposing** `Email & DNS Setup — Domains, Mailboxes & Records.md` — you edited it +- **proposed** `Email & DNS Setup — Domains, Mailboxes & Records.md` → `300 areas/360 Dev-Ops Network Computers` (folder already set — kept) (confidence 0.49) +- - Low JEV confidence — recommend human confirmation