Review: DNS: SPF/DKIM/DMARC records for westsidekingsandqueens.com

review-1738-2026-07-03 Review

review needs-refinement

Project

Template Completeness

[x] Type (Feature)
[x] Lineage
[x] Repo
[x] User Story
[x] Context
[x] File Targets (present but vague -- see below)
[x] Feature Flag
[x] Acceptance Criteria
[x] Test Expectations
[x] Constraints
[x] Checklist
[x] Related

Traceability

[x] story:custom-domain label -- "As platform admin, I want each app to send from its own domain so emails look professional and build domain reputation"
[x] story note verified -- found in project-stalwart-email user-stories section
[x] arch:dns label -- DNS component
[ ] arch note MISSING -- [SCOPE] Create architecture note arch-dns for DNS component
[x] Forgejo issue -- https://forgejo.tail5b443a.ts.net/ldraney/pal-e-services/issues/166, open

File Targets

[ ] "GoDaddy DNS configuration" -- ISSUE: Not an actual file path. DNS A records for westsidekingsandqueens.com already exist in pal-e-platform/terraform/dns.tf (lines 20-26). SPF/DKIM/DMARC records should logically go in the same file. However, no email auth DNS records exist for ANY domain in IaC (including landscaping-assistant.app), suggesting these may be managed manually via GoDaddy web UI.

Repo Placement

MISMATCH: Issue is filed on ldraney/pal-e-services but DNS records are managed in pal-e-platform/terraform/dns.tf. The pal-e-services repo handles service automation (ArgoCD, Keycloak, Harbor, CNPG, databases) -- not DNS records. The A record for westsidekingsandqueens.com already exists in pal-e-platform. If SPF/DKIM/DMARC records will be managed via IaC, they belong in pal-e-platform. If they are manual GoDaddy UI operations, the issue body should explicitly state that and the file targets section should say "No IaC changes -- manual GoDaddy UI configuration."

Dependencies

Lineage states: "Depends on: Stalwart domain/account setup (needs DKIM public key)"
Board item #1736 (pal-e-services#164): "Stalwart: Create domains + SMTP accounts via API" -- this generates the DKIM public key needed for this ticket. Currently in backlog.
Board item #1733 (pal-e-platform#498): "Salt: Install Stalwart binary + systemd service on edge VPS" -- prerequisite to #1736. Currently in backlog.
Dependency chain: #1733 -> #1736 -> #1738 (this ticket). Both dependencies are in backlog. The DKIM public key cannot be obtained until Stalwart is installed and configured.

Acceptance Criteria

5 criteria -- all verifiable with standard DNS dig commands and mxtoolbox.com. Criteria are concrete and agent-testable. However, DKIM criterion requires the public key from Stalwart (dependency #1736), making this ticket unimplementable until that dependency is resolved.

Blast Radius

Low. Changes affect only westsidekingsandqueens.com DNS records. No downstream services affected. Constraint about merging with existing SPF record (possible Gmail SPF) is appropriately noted.

Decomposition Assessment

1 logical file target, 5 acceptance criteria, single domain scope. Estimated agent time under 5 minutes once dependency resolved and repo/target clarified. No decomposition needed.

Recommendations

[BODY] Fix Repo field: change from ldraney/pal-e-services to ldraney/pal-e-platform if records will be IaC-managed, OR clarify in File Targets that this is manual GoDaddy UI work with no code changes.
[BODY] Fix File Targets: replace "GoDaddy DNS configuration" with either terraform/dns.tf (in pal-e-platform) or "Manual: GoDaddy DNS web UI (no IaC file changes)".
[BODY] Clarify "Same pattern as landscaping-assistant.app" -- no SPF/DKIM/DMARC records exist in IaC for any domain. If that pattern was manual, state it explicitly so the agent knows the approach.
[BODY] Add explicit dependency reference: "Blocked by board item #1736 (pal-e-services#164: Stalwart domain/account setup)" so ordering is machine-readable.
[SCOPE] Create architecture note arch-dns for DNS component (previously flagged in review-1624-2026-06-28).