Repository navigation
DNS best practices for operationcode.org and operationcode.net - #193
Conversation
…erationcode.net protection, DNSSEC signing, query logging Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| # ====================================================================== | ||
|
|
||
| # Google Workspace mail | ||
| # Replaced this zone's legacy ASPMX records with Google's current single MX on 2026-11-01. Google still supports the old values. |
There was a problem hiding this comment.
low bug, confidence low, pass review
Comment cites a specific date that may be wrong or future
The comment claims the MX was replaced on a specific date (2026-11-01). The date cannot be verified from the bundle and may be inaccurate, but it has no runtime effect.
Model output from untrusted input. Check it before you act on it.
| sid = "Route53QueryLogging" | ||
| effect = "Allow" | ||
| actions = ["logs:CreateLogStream", "logs:PutLogEvents"] | ||
| resources = ["arn:aws:logs:us-east-1:${data.aws_caller_identity.current.account_id}:log-group:/aws/route53/*"] |
There was a problem hiding this comment.
low security, confidence medium, pass security
Log policy grants Route53 write to all /aws/route53/* log groups
The CloudWatch resource policy allows route53.amazonaws.com to write to any log group under /aws/route53/* in the account, not only the new operationcode.org group. It is limited by SourceAccount and hostedzone SourceArn conditions, so only this account's Route53 zones can use it. The risk is small, but scoping to the specific log group ARN would follow least privilege.
Model output from untrusted input. Check it before you act on it.
🟡 Clear to proceed: Claude of Duty logged 3 items to considerMission: Review the code. Protect the branch. Deploy the future. Note 3 findings to consider. They do not block this PR.
Run 41327313970, attempt 1 for head Claude of Duty never approves a PR. A human reviewer gives the final approval. 📋 Full review record: reasons, checks, signals, finding details, model summaries, token usageReviewed snapshot
Reasons the gate failed None. No reason applies. Checks (code, no model)
Signals (context only, never block)
Dependency changes None. Finding details
Blocking is decided by code from category and severity, never by the model. A finding in a blocking category blocks only at high or critical severity.
The Supply chain pass completed and reported no findings. Model summaries
Token usage
|
Imports applied locally (3 imported). Stray operationcode.org.operationcode.net MX/SPF/TXT records deleted by hand. terraform plan reports No changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Applied locally from this branch: 3 imported, 16 added, 5 changed, 0 destroyed. Stray operationcode.org.operationcode.net MX/SPF/TXT deleted by hand. Import blocks removed (this commit). |
| # ====================================================================== | ||
|
|
||
| # Google Workspace mail | ||
| # Replaced this zone's legacy ASPMX records with Google's current single MX on 2026-11-01. Google still supports the old values. |
There was a problem hiding this comment.
medium bug, confidence medium, pass review
Comment cites a future/unverifiable change date
The comment asserts the MX replacement happened on 2026-11-01, which may be a wrong or future date. It is misleading about when the change was made, but has no runtime effect.
Model output from untrusted input. Check it before you act on it.
| name = "operationcode_org_ksk" | ||
| } | ||
|
|
||
| resource "aws_route53_hosted_zone_dnssec" "operationcode" { |
There was a problem hiding this comment.
medium bug, confidence low, pass review
Query logging and DNSSEC changes in one apply may race
The DNSSEC signing resource has no dependency on the KMS alias or the key policy being fully propagated. KMS policy eventual consistency can make the KSK creation fail on first apply. A retry normally resolves it.
Model output from untrusted input. Check it before you act on it.
| sid = "Route53QueryLogging" | ||
| effect = "Allow" | ||
| actions = ["logs:CreateLogStream", "logs:PutLogEvents"] | ||
| resources = ["arn:aws:logs:us-east-1:${data.aws_caller_identity.current.account_id}:log-group:/aws/route53/*"] |
There was a problem hiding this comment.
low security, confidence low, pass security
Route53 log policy allows writes to any /aws/route53/* log group
The account-wide CloudWatch Logs resource policy lets Route53 write to any log group under /aws/route53/* for any hosted zone in the account. It is scoped by source account, so exposure is limited to this account's own zones. The policy could instead name the specific log group and zone, so this is a minor least-privilege gap.
Model output from untrusted input. Check it before you act on it.
Summary
DNS best-practice changes for operationcode.org and operationcode.net. Follow-up to #192.
operationcode.org (
terraform/dns_operationcode_org.tf)issuetags foramazon.com,amazontrust.comandletsencrypt.org. Before this, any CA could issue for the apex. The served cert issuer of every hostname was checked: only Amazon (ACM) and Let's Encrypt (Vercel) issue for our names.1 smtp.google.com.. Google still supports the old values, so this is cleanup.rua=mailto:tech@operationcode.organd raise the TTL to 3600. The policy staysp=noneuntil Google Workspace DKIM is set up.k2/k3. Values unchanged.v=spf1 -allon hosts that never send mail:www,api,pybot,resources,api.staging. Cloudways and DigitalOcean hosts are excluded until their owners are confirmed.operationcode.net (
terraform/dns_operationcode_net.tf, new)aws_route53_zonewithprevent_destroy, plus the apex alias andwwwCNAME (no changes on import).v=spf1 -all, null MX0 .(RFC 7505), and_dmarcwithp=reject; sp=reject.operationcode.net._report._dmarc.operationcode.orgTXT authorizes operationcode.org to receive the .net DMARC reports.operationcode.org.operationcode.net(MX, SPF, TXT) are not imported. They are deleted by hand.DNSSEC and query logging (
terraform/dns_operationcode_org_security.tf, new)ECC_NIST_P256,SIGN_VERIFY,prevent_destroy) with the Route53 DNSSEC key policy, a key-signing key, andaws_route53_hosted_zone_dnssec.aws route53 get-dnssecshowsSIGNING,dig +dnssec operationcode.orgshows RRSIG records, and 48 hours have passed (the apex NS TTL). A DS record before signing works would take the domain offline. The file documents the rollback order.Plan
3 to import, 16 to add, 5 to change, 0 to destroy. Plans run locally; CI does not apply.Rollout
cd terraform && terraform plan, and confirm the line above.terraform applyfrom this branch.terraform planreportsNo changes.Not in this PR
quarantine/rejectfor operationcode.org.-alland the Mailgun include.services,kibana,mautic,test,slash-commands) and DigitalOcean (community,nfs.services) owner checks.🤖 Generated with Claude Code