Backlog: Security & deployment hardening
Problem
DMARC is not configured on mill.keywind.cc. Replies currently land in the recipient's inbox (verified with Proton), so this is low priority today — but it matters for deliverability at scale and is a prerequisite before any migration to the real domain (whidit.com).
Proposed solution
- Add a DMARC TXT record at
_dmarc.mill.keywind.cc (start p=none, monitor-only), aligned with the existing SPF + DKIM that Mailgun already verifies.
- Watch out for the Cloudflare gotcha documented in
EMAIL-PIPELINE.md: Cloudflare's DMARC Management feature silently reasserts a competing dmarc-reports.cloudflare.net record unless disabled per-zone (Email → DMARC Management → disable). And Cloudflare's DNS form auto-appends the zone, so enter the name as _dmarc.mill, not the full host.
Notes
- Only pursue as part of improving reply deliverability or the whidit.com migration; not needed for current functionality.
Backlog: Security & deployment hardening
Problem
DMARC is not configured on
mill.keywind.cc. Replies currently land in the recipient's inbox (verified with Proton), so this is low priority today — but it matters for deliverability at scale and is a prerequisite before any migration to the real domain (whidit.com).Proposed solution
_dmarc.mill.keywind.cc(startp=none, monitor-only), aligned with the existing SPF + DKIM that Mailgun already verifies.EMAIL-PIPELINE.md: Cloudflare's DMARC Management feature silently reasserts a competingdmarc-reports.cloudflare.netrecord unless disabled per-zone (Email → DMARC Management → disable). And Cloudflare's DNS form auto-appends the zone, so enter the name as_dmarc.mill, not the full host.Notes