Skip to content

fix: clawbench email dns #178

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Perry2004 merged 2 commits into from
Mar 20, 2026
Merged

fix: clawbench email dns #178

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fd07ab3
fix: clawbench email dns
Perry2004 Mar 20, 2026
691226d
Merge branch 'main' into clawbench-dns
Perry2004 Mar 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
72 changes: 24 additions & 48 deletions common/dns/clawbench.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,80 +1,56 @@
resource "aws_route53_zone" "clawbench_subzone" {
name = "clawbench.${var.domain_name}"
}
# Purelymail DNS records for clawbench.perryz.net

resource "aws_route53_record" "clawbench_ns" {
# MX record
resource "aws_route53_record" "clawbench_mx" {
zone_id = aws_route53_zone.perryz_net_zone.zone_id
name = "clawbench.${var.domain_name}"
Comment on lines +3 to 6
Copy link

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change removes the delegated clawbench hosted zone/NS delegation and instead manages all email records directly in the parent perryz_net_zone. That will cause Terraform to destroy the clawbench hosted zone in state, which can fail if the zone contains any unmanaged records (and can cause DNS cutover/downtime depending on TTLs). Consider confirming the hosted zone is otherwise empty / not referenced elsewhere before applying, or documenting the required migration steps (and/or using force_destroy if appropriate).

Copilot uses AI. Check for mistakes.
type = "NS"
ttl = "300"
records = aws_route53_zone.clawbench_subzone.name_servers
}

# MX Record
resource "aws_route53_record" "clawbench_mx" {
zone_id = aws_route53_zone.clawbench_subzone.zone_id
name = ""
type = "MX"
ttl = "3600"
records = [
"10 mailserver.purelymail.com."
]
ttl = 3600
records = ["10 mailserver.purelymail.com."]
}

# TXT / SPF Record
# SPF record
resource "aws_route53_record" "clawbench_spf" {
zone_id = aws_route53_zone.clawbench_subzone.zone_id
name = ""
type = "TXT"
ttl = "3600"
records = [
"v=spf1 include:_spf.purelymail.com ~all"
]
}

# Ownership TXT Record
resource "aws_route53_record" "clawbench_ownership" {
zone_id = aws_route53_zone.clawbench_subzone.zone_id
zone_id = aws_route53_zone.perryz_net_zone.zone_id
name = "clawbench.${var.domain_name}"
type = "TXT"
ttl = "300"
ttl = 3600
records = [
"purelymail_ownership_proof=05ebc6732a9fdf83aaac36fac2bfc3df55b2c5c3a698f16e89086d610c7265e2777f2982e1646833e0eca00f6835ad74dc00b98fde13c4b6e7ab16d4c29032aa"
"v=spf1 include:_spf.purelymail.com ~all",
"purelymail_ownership_proof=05ebc6732a9fdf83aaac36fac2bfc3df55b2c5c3a698f16e89086d610c7265e2777f2982e1646833e0eca00f6835ad74dc00b98fde13c4b6e7ab16d4c29032aa",
]
Comment on lines +12 to 21
Copy link

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

clawbench_spf now contains both the SPF value and the purelymail_ownership_proof TXT value. The resource name/comment are misleading, and it makes future updates (e.g., rotating ownership vs SPF) harder to reason about. Consider either splitting this into two aws_route53_record resources (same name/type but different set_identifier / separate records) or renaming the resource/comment to reflect that it manages multiple TXT records.

Copilot uses AI. Check for mistakes.
}

# DKIM Records
resource "aws_route53_record" "clawbench_dkim_1" {
zone_id = aws_route53_zone.clawbench_subzone.zone_id
# DKIM records
resource "aws_route53_record" "clawbench_dkim1" {
zone_id = aws_route53_zone.perryz_net_zone.zone_id
name = "purelymail1._domainkey.clawbench.${var.domain_name}"
type = "CNAME"
ttl = "3600"
ttl = 3600
records = ["key1.dkimroot.purelymail.com."]
}

resource "aws_route53_record" "clawbench_dkim_2" {
zone_id = aws_route53_zone.clawbench_subzone.zone_id
resource "aws_route53_record" "clawbench_dkim2" {
zone_id = aws_route53_zone.perryz_net_zone.zone_id
name = "purelymail2._domainkey.clawbench.${var.domain_name}"
type = "CNAME"
ttl = "3600"
ttl = 3600
records = ["key2.dkimroot.purelymail.com."]
}

resource "aws_route53_record" "clawbench_dkim_3" {
zone_id = aws_route53_zone.clawbench_subzone.zone_id
resource "aws_route53_record" "clawbench_dkim3" {
zone_id = aws_route53_zone.perryz_net_zone.zone_id
name = "purelymail3._domainkey.clawbench.${var.domain_name}"
type = "CNAME"
ttl = "3600"
ttl = 3600
records = ["key3.dkimroot.purelymail.com."]
}

# DMARC Record
# DMARC record
resource "aws_route53_record" "clawbench_dmarc" {
zone_id = aws_route53_zone.clawbench_subzone.zone_id
zone_id = aws_route53_zone.perryz_net_zone.zone_id
name = "_dmarc.clawbench.${var.domain_name}"
type = "CNAME"
ttl = "3600"
records = [
"dmarcroot.purelymail.com."
]
ttl = 3600
records = ["dmarcroot.purelymail.com."]
Comment on lines 50 to +55
Copy link

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The DMARC record is being published as a CNAME to dmarcroot.purelymail.com.. Elsewhere in this repo DMARC is consistently published as a TXT record at _dmarc.<domain> (e.g. apps/cloud-chat-app/usw2dev/dns.tf:26-32). If Purelymail doesn’t explicitly require a CNAME-based DMARC setup, consider switching this to a TXT v=DMARC1; ... policy record to align with the repo’s established DMARC pattern and avoid DMARC evaluation issues.

Copilot uses AI. Check for mistakes.
}