dns updates

[DaMandal0rian]

PR Type

enhancement

---

Description

• Updated SPF records in dns/autonomys-xyz.tf by removing 'a mx' mechanisms to streamline the SPF configuration.
• Changed DMARC policy from 'quarantine' to 'reject' to enhance email security.
• Added new DNS records in dns/subspace-foundation.tf for various services including 'ambassador', 'bootstrap', and 'rpc' to support subspace foundation infrastructure.

---

Changes walkthrough 📝

Relevant files

Enhancement

autonomys-xyz.tf Update SPF and DMARC records for autonomys.xyz                      dns/autonomys-xyz.tf Updated SPF record by removing 'a mx' mechanisms. Changed DMARC policy from 'quarantine' to 'reject'. +3/-3      subspace-foundation.tf Add DNS records for subspace foundation services                  dns/subspace-foundation.tf Added new CNAME record for 'ambassador'. Added TXT record for '_notion-dcv.ambassador'. Added multiple A records for 'bootstrap', 'rpc' services. +63/-0

---

💡 PR-Agent usage: Comment /help "your question" on any pull request to receive relevant information

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review SPF Configuration The SPF record change removes 'a mx' mechanisms which might affect email deliverability. Ensure that this change does not negatively impact legitimate email flow. DMARC Policy Changing DMARC policy from 'quarantine' to 'reject' could lead to legitimate emails being rejected. This change should be carefully reviewed to ensure it aligns with the desired email security posture.

[github-actions]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Score
Security	Enable Cloudflare proxying for critical DNS records to enhance security Consider setting the 'proxied' attribute to true for the 'rpc_mainnet', 'rpc_devnet', and other similar records to leverage Cloudflare's security features and DDoS protection, which can help shield the underlying IP addresses from direct attacks. dns/subspace-foundation.tf [103] -proxied = false +proxied = true Suggestion importance[1-10]: 7 Why: Enabling Cloudflare proxying for critical DNS records like 'rpc_mainnet' and 'rpc_devnet' can significantly enhance security by leveraging Cloudflare's security features and DDoS protection. This is a substantial security improvement.	7
Enhancement	Add 'a' and 'mx' mechanisms to the SPF record to improve email deliverability Consider adding the 'a' and 'mx' mechanisms back into the SPF record for 'mail.autonomys.xyz' to ensure that the domain's A records and MX records are included in the SPF validation, which can help prevent legitimate emails from being marked as spam. dns/autonomys-xyz.tf [120] -value = "v=spf1 include:_spf.google.com include:sendgrid.net ~all" +value = "v=spf1 a mx include:_spf.google.com include:sendgrid.net ~all" Suggestion importance[1-10]: 6 Why: Adding 'a' and 'mx' mechanisms to the SPF record can enhance email deliverability by ensuring that the domain's A records and MX records are included in SPF validation. This is a valid enhancement but not critical.	6
Performance	Standardize TTL values for critical infrastructure DNS records to enhance network stability Ensure consistent TTL values for records that are critical for network infrastructure, such as 'rpc_mainnet', 'rpc_devnet', and others, to avoid frequent DNS lookups that could impact the performance and reliability of network services. dns/subspace-foundation.tf [102] -ttl = 1 # Auto +ttl = 3600 Suggestion importance[1-10]: 5 Why: Standardizing TTL values to a higher setting like 3600 seconds for critical infrastructure records could potentially enhance network stability by reducing DNS lookup frequency. This is a moderate improvement suggestion.	5
Best practice	Modify the DMARC policy to 'quarantine' to reduce potential disruptions Update the DMARC policy from 'reject' to 'quarantine' for a safer deployment, allowing monitoring of the impact before fully enforcing the rejection of non-aligned emails, which helps in avoiding disruption of legitimate email traffic. dns/autonomys-xyz.tf [136] -value = "v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected]; aspf=r; adkim=r;" +value = "v=DMARC1; p=quarantine; rua=mailto:[email protected]; ruf=mailto:[email protected]; aspf=r; adkim=r;" Suggestion importance[1-10]: 4 Why: Changing the DMARC policy from 'reject' to 'quarantine' can help in monitoring impacts before fully enforcing it, which could avoid potential disruptions. However, the suggestion contradicts the PR's intent to strengthen the policy by setting it to 'reject'.	4