[byjpr]

Closes #13

Changes

• scripts/dns-preflight.py runs in just apply before the Cloudflare step. It lists every record in the zones through the Cloudflare API, drops the ones already in our Terraform state, and stops with a list of conflicts:

  • another MX, A/AAAA, SRV or CAA record at a name we manage;
  • any record next to our CNAME (mta-sts.<domain>);
  • a TXT record with the same tag as ours (v=spf1, v=DMARC1, v=STSv1, v=TLSRPTv1, v=DKIM1). Unrelated TXT records such as site verifications are fine.

  DNS_PREFLIGHT=skip overrides it.

• just check (any DNS host, including dns = "manual") now flags:

  • more than one SPF record (SPF permerror);
  • more than one DMARC record;
  • any MX record other than exactly 10 <fqdn>..

Testing

• Preflight against a fake Cloudflare API with a typical "moved from Google Workspace" zone:
  • Flagged: the old aspmx.l.google.com MX, the old v=spf1 include:_spf.google.com record and an old v=DMARC1; p=none record.
  • Ignored: our own managed MX (ID in state), a google-site-verification TXT and an unrelated www A record.
  • Exit 1 with conflicts, 0 without.
• The jq that builds the desired record list works with and without IPv6, and with an empty Terraform state.
• All 5 provider example systems build. nixfmt, shellcheck and tofu validate pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01G22o7QQ17GRtkCqpJNFr9B

---

Generated by Claude Code