operationcode_infra/terraform/route53.tf at 47fa1170eb11deea99ee16af8318e0515860b6bd · OperationCode/operationcode_infra · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
# Reference existing Route53 hosted zone
data "aws_route53_zone" "operationcode" {
  name = "operationcode.org."
}

# MX record for SES email receiving
resource "aws_route53_record" "coders_mx" {
  zone_id = data.aws_route53_zone.operationcode.zone_id
  name    = "coders.operationcode.org"
  type    = "MX"
  ttl     = 300
  records = ["10 inbound-smtp.us-east-1.amazonaws.com"]
}

# SPF record for email authentication
resource "aws_route53_record" "coders_spf" {
  zone_id = data.aws_route53_zone.operationcode.zone_id
  name    = "coders.operationcode.org"
  type    = "TXT"
  ttl     = 300
  records = ["v=spf1 include:amazonses.com ~all"]
}

# DKIM records (3 tokens from SES)
resource "aws_route53_record" "coders_dkim" {
  count   = 3
  zone_id = data.aws_route53_zone.operationcode.zone_id
  name    = "${module.ses_email_forwarder.ses_dkim_tokens[count.index]}._domainkey.coders.operationcode.org"
  type    = "CNAME"
  ttl     = 300
  records = ["${module.ses_email_forwarder.ses_dkim_tokens[count.index]}.dkim.amazonses.com"]
}

# Custom MAIL FROM domain - MX record
resource "aws_route53_record" "coders_bounce_mx" {
  zone_id = data.aws_route53_zone.operationcode.zone_id
  name    = "bounce.coders.operationcode.org"
  type    = "MX"
  ttl     = 300
  records = ["10 feedback-smtp.us-east-1.amazonses.com"]
}

# Custom MAIL FROM domain - SPF record
resource "aws_route53_record" "coders_bounce_spf" {
  zone_id = data.aws_route53_zone.operationcode.zone_id
  name    = "bounce.coders.operationcode.org"
  type    = "TXT"
  ttl     = 300
  records = ["v=spf1 include:amazonses.com ~all"]
}

# DMARC record for email policy
# p=quarantine: Failed authentication emails are sent to spam
# adkim=r, aspf=r: Relaxed alignment (allows subdomain alignment like bounce.coders.operationcode.org)
# pct=100: Apply policy to 100% of failing messages
resource "aws_route53_record" "coders_dmarc" {
  zone_id = data.aws_route53_zone.operationcode.zone_id
  name    = "_dmarc.coders.operationcode.org"
  type    = "TXT"
  ttl     = 300
  records = ["v=DMARC1; p=quarantine; adkim=r; aspf=r; pct=100"]
}