coilyco-flight-deck/infrastructure

Watch

coilysiren.me: add the Bing Webmaster Tools verification token. Blocked on Kai #915

New issue

Closed

opened 2026-08-25 01:16:37 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-08-25 01:16:37 +00:00

Member

What is left

No MS= record exists on the apex. Bing Webmaster Tools is worth adding for the Netlify-hosted site at coilysiren.me, but the token has to be generated from that account first, so it cannot be constructed from outside.

Once Kai supplies it, it joins the apex TXT list in aws_route53_record.txt in terraform/aws-inventory/main.tf. Route53 stores every TXT value for one name in a single record set, so it is one more entry in the existing "@" list beside the two google-site-verification tokens.

Apply must stay targeted while #914 is open.

What dissolved, and why

DKIM - unnecessary. A domain that sends no mail has nothing to sign. v=spf1 -all and p=reject already tell receivers to reject anything claiming to come from it.
SPF and DMARC hardening - done in #918, immediately and without a monitoring period. The monitor-then-harden sequence #911 specified existed to avoid breaking a legitimate sender. There is no longer one, so ~all went to -all and p=none went to p=reject; sp=reject in a single step.
The cross-domain rua problem - moot. There is no rua, because a domain with no legitimate sender has no report traffic worth collecting.

The domain now has a stricter anti-spoofing posture than it ever had while Workspace ran it.

Done means

dig +short @8.8.8.8 coilysiren.me TXT returns an MS= token alongside the two existing google-site-verification tokens, and Bing Webmaster Tools shows the site as verified.

Rewritten. This issue originally carried DKIM, Bing verification, and the SPF and DMARC hardening. Google Workspace went down before any of it started, Kai confirmed nothing recovers through `kai@coilysiren.me`, and the domain was retired as a mail domain in #918 instead. Only the Bing item survives, and it was never about mail. ## What is left No `MS=` record exists on the apex. Bing Webmaster Tools is worth adding for the Netlify-hosted site at `coilysiren.me`, but the token has to be generated from that account first, so it cannot be constructed from outside. Once Kai supplies it, it joins the apex `TXT` list in `aws_route53_record.txt` in `terraform/aws-inventory/main.tf`. Route53 stores every TXT value for one name in a single record set, so it is one more entry in the existing `"@"` list beside the two `google-site-verification` tokens. Apply must stay targeted while #914 is open. ## What dissolved, and why * **DKIM** - unnecessary. A domain that sends no mail has nothing to sign. `v=spf1 -all` and `p=reject` already tell receivers to reject anything claiming to come from it. * **SPF and DMARC hardening** - done in #918, immediately and without a monitoring period. The monitor-then-harden sequence #911 specified existed to avoid breaking a legitimate sender. There is no longer one, so `~all` went to `-all` and `p=none` went to `p=reject; sp=reject` in a single step. * **The cross-domain `rua` problem** - moot. There is no `rua`, because a domain with no legitimate sender has no report traffic worth collecting. The domain now has a stricter anti-spoofing posture than it ever had while Workspace ran it. ## Done means `dig +short @8.8.8.8 coilysiren.me TXT` returns an `MS=` token alongside the two existing `google-site-verification` tokens, and Bing Webmaster Tools shows the site as verified.

coilyco-ops referenced this issue

2026-08-25 01:16:54 +00:00

coilysiren.me DNS: add second Google verification token, and add SPF and DMARC to an unauthenticated mail domain #911

coilyco-ops referenced this issue

2026-08-25 02:00:56 +00:00

feat(dns): retire coilysiren.me mail as a non-sending domain #918

coilyco-ops changed title from ~~coilysiren.me mail: add DKIM, then harden SPF and DMARC. Blocked on Kai for the console-only inputs~~ to coilysiren.me: add the Bing Webmaster Tools verification token. Blocked on Kai

2026-08-25 02:04:12 +00:00

coilyco-ops commented

2026-08-25 02:04:31 +00:00

Author

Member

Applied. coilysiren.me is now a non-sending, non-receiving domain. Merged as #918, squashed to 22d0116 on main.

After-state

Authoritative (ns-1394.awsdns-46.org) and public (8.8.8.8) agree:

coilysiren.me           MX   0 .
coilysiren.me           TXT  "google-site-verification=AvxW9N5GEqed5vSgm6OHGpnOdPfFgAKSU0-94Ls1iew"
                             "google-site-verification=cx2k2l_2F2Pqb_5HrLe03mMu5x_EHU8znVXkfmPmGV8"
                             "v=spf1 -all"
_dmarc.coilysiren.me    TXT  "v=DMARC1; p=reject; sp=reject"
_atproto.coilysiren.me  TXT  "did=did:plc:xvgmere7jp42xfc5xn47lvyi"
_discord.coilysiren.me  TXT  "dh=caaf268c3e61b84d806cf8c4e3d502be5f7be768"

Apply complete! Resources: 0 added, 3 changed, 0 destroyed.

Both verification tokens survived the apex TXT rewrite. _atproto and _discord are byte-identical. The web records are untouched: apex A still resolves 75.2.60.5 and www still points at the Netlify site.

Applied with -target

Same reason as #911. An untargeted apply on this module still destroys three live A records, tracked in #914. The three addresses targeted here were txt["@"], dmarc, and mx.

What this closes out

The mail work from #911 is superseded rather than extended. This issue is now Bing verification only, per the rewritten body above.

Reverting is a single commit if mail ever comes back.

Applied. `coilysiren.me` is now a non-sending, non-receiving domain. Merged as #918, squashed to `22d0116` on `main`. ## After-state Authoritative (`ns-1394.awsdns-46.org`) and public (`8.8.8.8`) agree: ``` coilysiren.me MX 0 . coilysiren.me TXT "google-site-verification=AvxW9N5GEqed5vSgm6OHGpnOdPfFgAKSU0-94Ls1iew" "google-site-verification=cx2k2l_2F2Pqb_5HrLe03mMu5x_EHU8znVXkfmPmGV8" "v=spf1 -all" _dmarc.coilysiren.me TXT "v=DMARC1; p=reject; sp=reject" _atproto.coilysiren.me TXT "did=did:plc:xvgmere7jp42xfc5xn47lvyi" _discord.coilysiren.me TXT "dh=caaf268c3e61b84d806cf8c4e3d502be5f7be768" ``` `Apply complete! Resources: 0 added, 3 changed, 0 destroyed.` Both verification tokens survived the apex TXT rewrite. `_atproto` and `_discord` are byte-identical. The web records are untouched: apex `A` still resolves `75.2.60.5` and `www` still points at the Netlify site. ## Applied with -target Same reason as #911. An untargeted apply on this module still destroys three live A records, tracked in #914. The three addresses targeted here were `txt["@"]`, `dmarc`, and `mx`. ## What this closes out The mail work from #911 is superseded rather than extended. This issue is now Bing verification only, per the rewritten body above. Reverting is a single commit if mail ever comes back.

coilyco-ops added the

role/human

priority

labels

2026-08-25 08:02:05 +00:00

coilyco-ops added the

autonomy

async-consult

label

2026-08-25 09:30:53 +00:00

coilyco-ops commented

2026-08-27 03:19:03 +00:00

Author

Member

Closed in the 2026-08-26 backlog burn-down (coilyco-bridge/agentic-os-kai#901).

Closing. Everything else in this issue was superseded by #918, and what is left is one Bing verification TXT record that cannot be constructed without a token from Kai's account. Refile as a one-line terraform change when she has the token.

This was priority/P3, the default tier that unsure and unscored issues land in, so it had never been positively judged worth keeping. The 2026-08-26 burn-down ranked the whole P3 pool and cut the bottom. Closed here means not on the list, not wrong or worthless.

If this is live work, reopen it. The whole set is recoverable with state:closed label:burndown-2026-08.

Closed in the 2026-08-26 backlog burn-down (coilyco-bridge/agentic-os-kai#901). Closing. Everything else in this issue was superseded by #918, and what is left is one Bing verification TXT record that cannot be constructed without a token from Kai's account. Refile as a one-line terraform change when she has the token. This was `priority/P3`, the default tier that unsure and unscored issues land in, so it had never been positively judged worth keeping. The 2026-08-26 burn-down ranked the whole P3 pool and cut the bottom. Closed here means not on the list, not wrong or worthless. If this is live work, reopen it. The whole set is recoverable with `state:closed label:burndown-2026-08`.

coilyco-ops

2026-08-27 03:19:05 +00:00

closed this issue
added the
burndown-2026-08
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/infrastructure#915

No description provided.

Rows
Columns