Fix DMARC

Author: irvingpop

terraform/route53.tf

@@ -31,11 +31,32 @@ resource "aws_route53_record" "coders_dkim" {
   records = ["${module.ses_email_forwarder.ses_dkim_tokens[count.index]}.dkim.amazonses.com"]
 }
 
+# Custom MAIL FROM domain - MX record
+resource "aws_route53_record" "coders_bounce_mx" {
+  zone_id = data.aws_route53_zone.operationcode.zone_id
+  name    = "bounce.coders.operationcode.org"
+  type    = "MX"
+  ttl     = 300
+  records = ["10 feedback-smtp.us-east-1.amazonses.com"]
+}
+
+# Custom MAIL FROM domain - SPF record
+resource "aws_route53_record" "coders_bounce_spf" {
+  zone_id = data.aws_route53_zone.operationcode.zone_id
+  name    = "bounce.coders.operationcode.org"
+  type    = "TXT"
+  ttl     = 300
+  records = ["v=spf1 include:amazonses.com ~all"]
+}
+
 # DMARC record for email policy
+# p=quarantine: Failed authentication emails are sent to spam
+# adkim=r, aspf=r: Relaxed alignment (allows subdomain alignment like bounce.coders.operationcode.org)
+# pct=100: Apply policy to 100% of failing messages
 resource "aws_route53_record" "coders_dmarc" {
   zone_id = data.aws_route53_zone.operationcode.zone_id
   name    = "_dmarc.coders.operationcode.org"
   type    = "TXT"
   ttl     = 300
-  records = ["v=DMARC1; p=none; rua=mailto:admin@operationcode.org"]
+  records = ["v=DMARC1; p=quarantine; adkim=r; aspf=r; pct=100"]
 }

terraform/ses_email_forwarding.tf

@@ -30,3 +30,16 @@ output "ses_dkim_tokens" {
   description = "DKIM tokens for DNS configuration"
   value       = module.ses_email_forwarder.ses_dkim_tokens
 }
+
+output "ses_mail_from_domain" {
+  description = "Custom MAIL FROM domain for DMARC alignment"
+  value       = module.ses_email_forwarder.mail_from_domain
+}
+
+output "ses_mail_from_dns_records" {
+  description = "DNS records required for custom MAIL FROM domain"
+  value = {
+    mx_record  = "MX: ${module.ses_email_forwarder.mail_from_domain} -> ${module.ses_email_forwarder.mail_from_mx_record}"
+    spf_record = "TXT: ${module.ses_email_forwarder.mail_from_domain} -> ${module.ses_email_forwarder.mail_from_spf_record}"
+  }
+}

terraform/ses_email_forwarding/main.tf

@@ -204,6 +204,17 @@ resource "aws_ses_domain_dkim" "coders" {
   domain = aws_ses_domain_identity.coders.domain
 }
 
+# Custom MAIL FROM domain for DMARC alignment
+# This configures SES to use bounce.coders.operationcode.org as the envelope sender
+resource "aws_ses_domain_mail_from" "coders" {
+  domain           = aws_ses_domain_identity.coders.domain
+  mail_from_domain = "bounce.${aws_ses_domain_identity.coders.domain}"
+
+  # BehaviorOnMXFailure: UseDefaultValue = use amazonses.com if DNS fails
+  # RejectMessage = reject emails if DNS fails (more strict)
+  behavior_on_mx_failure = "UseDefaultValue"
+}
+
 # SES Receipt Rule Set
 resource "aws_ses_receipt_rule_set" "main" {
   rule_set_name = "coders-email-forwarding"

terraform/ses_email_forwarding/outputs.tf

@@ -48,3 +48,18 @@ output "ses_configuration_set_name" {
   description = "Name of the SES configuration set"
   value       = aws_ses_configuration_set.main.name
 }
+
+output "mail_from_domain" {
+  description = "Custom MAIL FROM domain for DMARC alignment"
+  value       = aws_ses_domain_mail_from.coders.mail_from_domain
+}
+
+output "mail_from_mx_record" {
+  description = "MX record value for the custom MAIL FROM domain (add this to DNS)"
+  value       = "10 feedback-smtp.us-east-1.amazonses.com"
+}
+
+output "mail_from_spf_record" {
+  description = "SPF TXT record value for the custom MAIL FROM domain (add this to DNS)"
+  value       = "v=spf1 include:amazonses.com ~all"
+}