Decision sorb: the mail hardening carried over from the mrtc diagnosis becomes an
issue. Writing it up corrected the premise the AAR and dns-soll.md carried:
#0006 hardened axion1337.DE, the zone with the real mailboxes, and it stands at
p=reject. The platform zone .chat was never its subject and still resolves its
_dmarc as a CNAME into IONOS' shared p=none - so the policy for our own domain is
set by IONOS, and RFC 7489 passes that none down to all seven service names.
Two senders are documented rather than assumed: Authentik as gamemaster@ via
IONOS SMTP (DKIM-covered), and maintenance-notify as wartung@ over an msmtp
config whose provider the template leaves open. That second path is why the issue
puts "clarify the senders" ahead of any policy change - p=reject before that
question is answered breaks maintenance mail silently.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The five-day group-call outage from the deleted mrtc A record had no management
record at all - the fix, the diagnosis path, and the lesson lived only in the
session. The AAR records why nothing alarmed (DNS-01 certs and pods stay green
without an A record), the exact dating via token-vs-join counts, and the
countermeasure that already shipped (notfallhandbuch dns-soll.md + pruefe-dns.sh).
gruppenpruefung's nine real-timestamp findings join #0053's history pass -
same class, same decision, recorded so the next session repairs nothing
unilaterally.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Thore CimbalandClaude Opus 5