Phase 2 — Email (inbound mailboxes + transactional outbound)

Part of Migration Plan — InMotion to Local + AWS Offsite. Blocked-by: none (can run parallel to Phase 1). Depends-on decision D3/D5/D6.

Goal

Deliver working email: real inbound mailboxes (webmail/IMAP) + transactional outbound per site — with deliverability credibility (reputation isolation, SPF/DKIM/DMARC).

Decisions (from main plan)

Inbound: managed provider — Zoho Mail (free ≤5 users). Chosen for audasmedia.com.au + where-woof.com first; more domains later.
Outbound: Amazon SES (~0.10/1000, effectively free at low volume).
Both on separate reputation islands (don't send transactional from mailbox provider).

DNS dependency (IMPORTANT — 2026-08-28)

Both domains are authoritative on InMotion nameservers (ns1/ns2.inmotionhosting.com), so MX/SPF/DKIM/DMARC records must be added there today. User chose to HOLD OFF on moving DNS to Cloudflare until InMotion infra is fully retired (defer; avoid outage risk).

audasmedia.com.au A → 173.231.229.92 (still InMotion VPS)
where-woof.com A → 144.6.86.11 (static IP, already local)
Not blocked by DNS: Amazon SES domain verification + outbound config can proceed now (verification tokens/CNAME are added later with records).

Sub-steps

2.1 Inbound mailboxes (user + config)

Pick provider (Zoho / MXroute).
Register custom domain mailbox(es) e.g. hello@where-woof.com + site addresses.
Set MX records on each domain → provider.
Add TXT SPF (include provider + SES), DKIM (provider + SES), DMARC.
Connect responders: Zoho webmail + Thunderbird/Gmail app via IMAP (993)/SMTP (465) if paid IMAP tier.

2.2 Outbound transactional (SES)

Verify sending domains/emails in SES (samuelrolfe@gmail.com, site domains).
Configure SPF/DKIM; exit SES sandbox (ticket/limit increase).
Optionally use FLoci (localhost:4566) to develop/test the SES API integration offline first.

2.3 Site integration (later, with CMS migration project)

Point site forms / password reset / notifications → SES SMTP or API.
(CMS code changes are the separate migration project — only wire-up decisions here.)

2.4 Monitor

Check bounces/complaints/deliverability dashboard.

Acceptance criteria

Can receive into a real mailbox and read via webmail/IMAP.
Can send a test transactional email through SES successfully (not sandbox-blocked).
DNS passes SPF/DKIM/DMARC checks (use MXToolbox).

OUTBOUND CHECKLIST — before websites send live mail (added 2026-09-01)

Request SES production access (free; ~hours approval) — required for sites to email any user (sandbox only sends to verified addresses): SES → Account dashboard → Request production access.
Get SES SMTP credentials (SES → SMTP Settings → create SMTP user; region ap-southeast-2; port 587 STARTTLS or 465 TLS).
Wire website/app to send FROM hello@<domain> via SES SMTP/API (sender + auth set in site config).
Send a live test FROM hello@where-woof.com → external address; verify DKIM/spf=pass.
(Later, optional) tighten DMARC from p=none to p=quarantine once legitimate traffic is established.

Personal sending options (as of 2026-09-01)

Gmail "Send mail as" → add hello@where-woof.com as an alias, outgoing via SES SMTP → send as where-woof from Gmail compose. Free.
Thunderbird: keep IMAP = Gmail (where mail lands), set SMTP = SES → send as where-woof.com. Free.
PurelyMail (~$10/yr, real domain mailboxes + IMAP/SMTP/POP) → alternative when real org mailboxes are wanted; gives Thunderbird native IMAP on your domain + independent storage. Deferred decision — current Cloudflare→Gmail stays $0.

See Migration Plan — InMotion to Local + AWS Offsite §6.

4.1 KiB Raw Blame History