aws-inventory README still describes coilysiren.me as non-receiving after #961 added SES inbound #970

New issue

Open

opened 2026-08-27 20:24:00 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-27 20:24:00 +00:00

Owner

Observed

terraform/aws-inventory/README.md:57-63 still reads:

So the domain is configured as a non-sending, non-receiving one:

MX is the RFC 7505 null MX, 0 ., which rejects immediately.

That was accurate after #918. It stopped being accurate at #961 (feat(dns): SES inbound for one allowlisted agent mailbox), which replaced the record in terraform/aws-inventory/main.tf:219 with:

records = ["10 inbound-smtp.us-east-1.amazonaws.com"]

main.tf carries a full and correct comment block explaining the reopening and its bounding. The README never followed.

Why it matters

The README is the doc a reader opens first for the mail posture. Today it returns the wrong answer on the receiving leg, and a reader who trusts it would conclude the domain rejects all inbound mail when it in fact accepts coilyco-ops@coilysiren.me into s3://coilysiren-inbound-mail/inbound/.

The non-sending half is still correct and should stay: SPF is v=spf1 -all, DMARC is p=reject; sp=reject, and DKIM is confirmed SigningEnabled: false / Status: NOT_STARTED against the live identity.

Acceptance

terraform/aws-inventory/README.md describes the current split posture: non-sending, and receiving exactly one allowlisted address via SES inbound to S3 with 30-day expiry. Retirement path back to 0 . stays documented.

Found while answering a question about whether the SES stack can send outbound. No configuration was changed.

## Observed `terraform/aws-inventory/README.md:57-63` still reads: > So the domain is configured as a non-sending, non-receiving one: > - `MX` is the RFC 7505 null MX, `0 .`, which rejects immediately. That was accurate after #918. It stopped being accurate at #961 (`feat(dns): SES inbound for one allowlisted agent mailbox`), which replaced the record in `terraform/aws-inventory/main.tf:219` with: ```hcl records = ["10 inbound-smtp.us-east-1.amazonaws.com"] ``` `main.tf` carries a full and correct comment block explaining the reopening and its bounding. The README never followed. ## Why it matters The README is the doc a reader opens first for the mail posture. Today it returns the wrong answer on the receiving leg, and a reader who trusts it would conclude the domain rejects all inbound mail when it in fact accepts `coilyco-ops@coilysiren.me` into `s3://coilysiren-inbound-mail/inbound/`. The non-sending half is still correct and should stay: SPF is `v=spf1 -all`, DMARC is `p=reject; sp=reject`, and DKIM is confirmed `SigningEnabled: false` / `Status: NOT_STARTED` against the live identity. ## Acceptance `terraform/aws-inventory/README.md` describes the current split posture: non-sending, and receiving exactly one allowlisted address via SES inbound to S3 with 30-day expiry. Retirement path back to `0 .` stays documented. Found while answering a question about whether the SES stack can send outbound. No configuration was changed.

coilyco-ops added this to the CI and repo hygiene milestone

2026-08-29 06:10:26 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/infrastructure#970

No description provided.

Rows
Columns