# DNS / SPF Audit — Client Domains

Audit of MX + SPF for all known client domains hosted on kaburusvr (Hetzner, 49.13.202.144). Dig run from kaburusvr 2026-07-14.

## Expected SPF includes by provider

| Provider | Expected include |
|----------|------------------|
| MS365 | `include:spf.protection.outlook.com` |
| Google | `include:_spf.google.com` |
| Zoho | `include:zoho.eu` |
| Proton | `include:_spf.protonmail.ch` |
| Cloudflare Email | `include:_spf.mx.cloudflare.net` |
| Self-hosted (kaburusvr) | `ip4:49.13.202.144` |

## Results (2026-07-14)

| Domain | MX Provider | SPF Include | Result |
|--------|-------------|-------------|--------|
| aberdeenrda.co.uk | Cloudflare | `_spf.mx.cloudflare.net` | MATCH |
| bankhousecatering.co.uk | Google | `_spf.google.com` | MATCH |
| billing.myretonmarquees.co.uk | none | none | NO EMAIL (known FF) |
| chippy.kaburu.co.uk | none | none | NO EMAIL (known FF) |
| claybusters.scot | Self-hosted (`mail.claybusters.scot`) | `ip4:49.13.202.144` | MATCH |
| dm-ph.com | MS365 | `spf.protection.outlook.com` | MATCH |
| doctorfin.co.uk | `_dc-mx.*` (residual M365 verify) | `ip4:49.13.202.144` | **MX BROKEN** |
| friendscic.org | Self-hosted (`mail.friendscic.org`) | `ip4:49.13.202.144` | MATCH |
| ggsgenerators.co.uk | Zoho | `zoho.eu` | MATCH |
| invoice.kaburu.co | none | none | NO EMAIL (known FF) |
| jafricasafari.com | MS365 | `spf.protection.outlook.com` | MATCH |
| kaburu.co | Proton | `_spf.protonmail.ch` **+** `ip4:49.13.202.144` | EXTRA IP |
| kaburu.co.uk | Proton | `_spf.protonmail.ch` **+** `ip4:49.13.202.144` | EXTRA IP |
| l8waterhygiene.co.uk | MS365 | `spf.protection.outlook.com` | MATCH |
| longniddrybowlingclub.com | Self-hosted | `ip4:49.13.202.144` | MATCH |
| longniddrybowlingclub.co.uk | Self-hosted | `ip4:49.13.202.144` | MATCH |
| myretonmarquees.co.uk | MS365 | `spf.protection.outlook.com` | MATCH |
| pilates-edinburgh.co.uk | `_dc-mx.*` (residual M365 verify) | `ip4:49.13.202.144` | **MX BROKEN** |
| stats.kaburu.co | none | none | NO EMAIL (known FF) |
| touchwell.co.uk | Self-hosted (`mail.touchwell.co.uk`) | `ip4:49.13.202.144` | MATCH |
| womenunlimited.africa | MS365 | `spf.protection.outlook.com` | MATCH |
| 24hrresponse.com | Proton | `_spf.protonmail.ch` **+** `ip4:49.13.202.144` | EXTRA IP |

Raw SPF on Proton domains (verified dig):
```
kaburu.co / kaburu.co.uk / 24hrresponse.com:
  v=spf1 mx a ip4:49.13.202.144 include:_spf.protonmail.ch -all
```

Broken MX raw:
```
doctorfin.co.uk:    10 _dc-mx.62e3cc93e6da.doctorfin.co.uk.  → A 49.13.202.144
pilates-edinburgh:  10 _dc-mx.5458ab873d17.pilates-edinburgh.co.uk. → A 49.13.202.144
```
`_dc-mx` hostnames resolve to kaburusvr, so inbound still lands if Postfix accepts the domain — but records are leftover M365 verification Mx, not proper `mail.<domain>` names. No Maildirs under `/home/vmail/` for either domain.

## Action items

1. **doctorfin.co.uk + pilates-edinburgh.co.uk (priority)**
   - Replace `_dc-mx.*` MX with `10 mail.<domain>` (and A/AAAA for mail. → 49.13.202.144) if self-hosted is intended
   - Or point MX to provider if mail lives elsewhere
   - No local mailboxes currently exist for either domain in `/home/vmail/`

2. **kaburu.co / kaburu.co.uk / 24hrresponse.com (cleanup)**
   - MX is Proton. SPF authorizes both Proton and `ip4:49.13.202.144`
   - Extra IP is intentional if server still sends (Brevo is also used; Postfix may send from this IP for system mail)
   - Keep `ip4:49.13.202.144` if any outbound still originates from kaburusvr; remove only if 100% Proton + Brevo with no direct Postfix

3. **No-MX subdomains (ignore)**
   - billing.myretonmarquees / chippy.kaburu / invoice.kaburu / stats.kaburu
   - Documented false flags — no email expected

## Re-run command

```bash
ssh -i /opt/hermes/config/hetzner_id_ed25519 root@100.112.54.2 \
  'for d in DOMAIN_LIST; do echo "=== $d ==="; dig +short MX $d; dig +short TXT $d | grep -i spf; done'
```