Since we send mails from host.vm.habhub.org, the SPF and DKIM stuff does not appear to fully work:
SPF flat out does not apply recursively
DKIM: Result: pass (signature verifies; identity doesn't match any headers)
It looks as though we may need
[x] _domainkey.host.vm.habhub.org for every host
[x] a TXT SPF record for every host.
[x] the support VM / exim relay to figure out which dkim_domain to say it is.
We have a couple of options
add a sync-public-dns command to habcloud-infra/vms/habcloud-vms that uses the Linode API
run a BIND server and do zone-transfers to linode.
The second option sucks because running BIND sucks. The first option is a bit sad because it means we need to worry about where we keep linode API credentials.
Could put them in ceto:/.linode-api; since if ceto gets pwned then we're pretty sad anyway
Could require them to be pasted in on each run
Note that we can recover the linode account if it's lost: it's a sub-account of mine (Daniel).
danielrichman
commented
9 years ago
Since we send mails from host.vm.habhub.org, the SPF and DKIM stuff does not appear to fully work:
Result: pass (signature verifies; identity doesn't match any headers)It looks as though we may need
_domainkey.host.vm.habhub.orgfor every hostdkim_domainto say it is.We have a couple of options
habcloud-infra/vms/habcloud-vmsthat uses the Linode APIThe second option sucks because running BIND sucks. The first option is a bit sad because it means we need to worry about where we keep linode API credentials.
ceto:/.linode-api; since if ceto gets pwned then we're pretty sad anyway