# DNS / SPF Audit — Client Domains

Audit of MX + SPF for all known client domains hosted on kaburusvr (Hetzner, 49.13.202.144). Dig run from kaburusvr 2026-07-14.

## Expected SPF includes by provider

Provider Expected include
———-——————
MS365 `include:spf.protection.outlook.com`
Google `include:_spf.google.com`
Zoho `include:zoho.eu`
Proton `include:_spf.protonmail.ch`
Cloudflare Email `include:_spf.mx.cloudflare.net`
Self-hosted (kaburusvr) `ip4:49.13.202.144`

## Results (2026-07-14)

Domain MX Provider SPF Include Result
——–————-————-——–
aberdeenrda.co.uk Cloudflare `_spf.mx.cloudflare.net` MATCH
bankhousecatering.co.uk Google `_spf.google.com` MATCH
billing.myretonmarquees.co.uk none none NO EMAIL (known FF)
chippy.kaburu.co.uk none none NO EMAIL (known FF)
claybusters.scot Self-hosted (`mail.claybusters.scot`) `ip4:49.13.202.144` MATCH
dm-ph.com MS365 `spf.protection.outlook.com` MATCH
doctorfin.co.uk `_dc-mx.*` (residual M365 verify) `ip4:49.13.202.144` MX BROKEN
friendscic.org Self-hosted (`mail.friendscic.org`) `ip4:49.13.202.144` MATCH
ggsgenerators.co.uk Zoho `zoho.eu` MATCH
invoice.kaburu.co none none NO EMAIL (known FF)
jafricasafari.com MS365 `spf.protection.outlook.com` MATCH
kaburu.co Proton `_spf.protonmail.ch` + `ip4:49.13.202.144` EXTRA IP
kaburu.co.uk Proton `_spf.protonmail.ch` + `ip4:49.13.202.144` EXTRA IP
l8waterhygiene.co.uk MS365 `spf.protection.outlook.com` MATCH
longniddrybowlingclub.com Self-hosted `ip4:49.13.202.144` MATCH
longniddrybowlingclub.co.uk Self-hosted `ip4:49.13.202.144` MATCH
myretonmarquees.co.uk MS365 `spf.protection.outlook.com` MATCH
pilates-edinburgh.co.uk `_dc-mx.*` (residual M365 verify) `ip4:49.13.202.144` MX BROKEN
stats.kaburu.co none none NO EMAIL (known FF)
touchwell.co.uk Self-hosted (`mail.touchwell.co.uk`) `ip4:49.13.202.144` MATCH
womenunlimited.africa MS365 `spf.protection.outlook.com` MATCH
24hrresponse.com Proton `_spf.protonmail.ch` + `ip4:49.13.202.144` EXTRA IP

Raw SPF on Proton domains (verified dig): ``` kaburu.co / kaburu.co.uk / 24hrresponse.com: 

v=spf1 mx a ip4:49.13.202.144 include:_spf.protonmail.ch -all

```

Broken MX raw: ``` doctorfin.co.uk: 10 _dc-mx.62e3cc93e6da.doctorfin.co.uk. → A 49.13.202.144 pilates-edinburgh: 10 _dc-mx.5458ab873d17.pilates-edinburgh.co.uk. → A 49.13.202.144 ``` `_dc-mx` hostnames resolve to kaburusvr, so inbound still lands if Postfix accepts the domain — but records are leftover M365 verification Mx, not proper `mail.<domain>` names. No Maildirs under `/home/vmail/` for either domain.

## Action items

1. doctorfin.co.uk + pilates-edinburgh.co.uk (priority)

  1. Replace `_dc-mx.*` MX with `10 mail.<domain>` (and A/AAAA for mail. → 49.13.202.144) if self-hosted is intended
  2. Or point MX to provider if mail lives elsewhere
  3. No local mailboxes currently exist for either domain in `/home/vmail/`

2. kaburu.co / kaburu.co.uk / 24hrresponse.com (cleanup)

  1. MX is Proton. SPF authorizes both Proton and `ip4:49.13.202.144`
  2. Extra IP is intentional if server still sends (Brevo is also used; Postfix may send from this IP for system mail)
  3. Keep `ip4:49.13.202.144` if any outbound still originates from kaburusvr; remove only if 100% Proton + Brevo with no direct Postfix

3. No-MX subdomains (ignore)

  1. billing.myretonmarquees / chippy.kaburu / invoice.kaburu / stats.kaburu
  2. Documented false flags — no email expected

## Re-run command

```bash ssh -i /opt/hermes/config/hetzner_id_ed25519 [email protected] \ 

'for d in DOMAIN_LIST; do echo "=== $d ==="; dig +short MX $d; dig +short TXT $d | grep -i spf; done'

```