pal-e-docs

Review: DNS: SPF/DKIM/DMARC records for landscaping-assistant.app

review-1737-2026-07-03-r2 Review

review ready
Project

Verdict: READY

Re-review of board item #1737 after refinement. All three issues from the previous review (review-1737-2026-07-03) are resolved.

Template Completeness

  • [x] Type (Feature)
  • [x] Lineage
  • [x] Repo (ldraney/pal-e-platform)
  • [x] User Story
  • [x] Context
  • [x] File Targets (terraform/dns.tf)
  • [x] Feature Flag (none)
  • [x] Acceptance Criteria
  • [x] Test Expectations
  • [x] Constraints
  • [x] Checklist
  • [x] Related
All sections present. Template structurally complete.

Traceability

  • [x] story:custom-domain label — "As platform admin, I want each app to send from its own domain so emails look professional and build domain reputation"
  • [x] story note verified — found in project-stalwart-email user-stories section (key: custom-domain, role: Platform Admin)
  • [x] arch:dns label — DNS component
  • [x] arch note verified — arch-dns note exists in pal-e-docs (created 2026-07-04, project: stalwart-email)
  • [x] Forgejo issue — ldraney/pal-e-services#165, open

File Targets

  • [x] terraform/dns.tf — verified: file exists in pal-e-platform, currently contains A records for landscaping-assistant.app (lines 12-18, resource "godaddy_dns_record" "landscaping_assistant_a"). SPF/DKIM/DMARC resources will be appended here using the same resource type pattern.

Repo Placement

OK. Issue filed on pal-e-services for project tracking. Body explicitly states ### Repo: ldraney/pal-e-platform and includes note: "Issue filed on pal-e-services for project tracking; implementation work is in pal-e-platform." The GoDaddy provider and existing DNS records live in pal-e-platform/terraform/. Cross-repo tracking is intentional and documented.

Dependencies

  • Documented: "Depends on: Stalwart domain/account setup (needs DKIM public key)" = pal-e-services#164 (board item #1736)
  • Transitive: #1736 depends on pal-e-platform#498 (Stalwart install, board item #1733)
  • Chain: #1733 (Stalwart install) → #1736 (domain/account setup, generates DKIM key) → #1737 (this item)
  • Both upstream items in backlog — this item is correctly blocked until DKIM public key is generated. Dependency is explicitly documented in Lineage section.

Acceptance Criteria

5 criteria, all verifiable programmatically:
  • [x] A record: verifiable via dig A mail.landscaping-assistant.app
  • [x] SPF: verifiable via dig TXT landscaping-assistant.app +short
  • [x] DKIM: verifiable via dig TXT default._domainkey.landscaping-assistant.app +short
  • [x] DMARC: verifiable via dig TXT _dmarc.landscaping-assistant.app +short
  • [x] mxtoolbox validation: verifiable via web check (24-48h propagation caveat noted in Constraints)
All criteria are clear, testable, and within agent capability. DKIM criterion naturally gated by Stalwart dependency.

Blast Radius

  • Sibling domain: Issue #166 (board item #1738) is the identical pattern for westsidekingsandqueens.com — no conflict, independent work
  • Third domain: palinks.app has an A record in dns.tf (lines 4-10) but no SPF/DKIM/DMARC — may need similar treatment in the future but out of scope for this ticket
  • Single SPF constraint: Issue correctly notes "Only ONE SPF record per domain" — no existing SPF record for landscaping-assistant.app in dns.tf, so no conflict risk
  • Provider pattern: Uses godaddy_dns_record resource type consistent with existing resources in the file

Decomposition Assessment

1 file target (terraform/dns.tf), 4 DNS resources to add (A for mail subdomain, SPF TXT, DKIM TXT, DMARC TXT), 5 acceptance criteria. Estimated agent work: under 5 minutes once DKIM key is available. No decomposition needed.

Previous Review Issues — Resolution Status

  • [x] Wrong repo — FIXED: ### Repo now correctly states ldraney/pal-e-platform
  • [x] Vague file targets — FIXED: File Targets now specifies terraform/dns.tf
  • [x] Missing arch-dns note — FIXED: arch-dns note created (Architecture: DNS Management)

Recommendation

No action needed. Scope is solid, all file targets verified, traceability complete, fits in a single agent pass.

Minor Observation (non-blocking)

The DKIM selector in the issue body uses default._domainkey while the arch-dns note references mail._domainkey. The actual selector will be determined by Stalwart's configuration during dependency #1736. The implementing agent should use whatever selector Stalwart generates rather than hardcoding either assumption. This is inherent to the dependency relationship and does not require ticket changes.