From 6f6f77302d50d58d4420c5cde4659a39c82e3e4c Mon Sep 17 00:00:00 2001 From: Aleksandr Albekov Date: Wed, 14 Oct 2026 22:56:55 +0200 Subject: [PATCH] Move DMARC to p=quarantine Step 1 of mail#5. Google's aggregate report for 2026-10-13 shows every message from bulbashenko.com passing DMARC through the aligned RSA DKIM signature, including one forwarded through Google where SPF fails. Only Stalwart sends for the domain (SPF "mx -all"), so quarantine should not affect legitimate mail. p=reject follows after a couple of clean weeks. Co-Authored-By: Claude Opus 5.5 --- terraform/dns.tf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/terraform/dns.tf b/terraform/dns.tf index 7451c71..7c24f5f 100644 --- a/terraform/dns.tf +++ b/terraform/dns.tf @@ -44,8 +44,8 @@ resource "cloudflare_dns_record" "autodiscover" { resource "cloudflare_dns_record" "dmarc_txt" { - comment = "[mail] DMARC, manual: p=none, tighten later" - content = "\"v=DMARC1; p=none; rua=mailto:dmarc@bulbashenko.com; adkim=s; aspf=s\"" + comment = "[mail] DMARC: quarantine, reject next (mail#5)" + content = "\"v=DMARC1; p=quarantine; rua=mailto:dmarc@bulbashenko.com; adkim=s; aspf=s\"" name = "_dmarc.bulbashenko.com" proxied = false ttl = 1