justin/new-site
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

mail: dedicate fresh IP .90 (mta01) to filings subdomain for clean reputation

Browse source 
Added a fresh sending IP (.90/mta01) bound to the filings cold-outreach stream,
isolated from the reputation-damaged .94 trucking IP:
- .90 bound on ens18, persisted 3 ways (interfaces up/down hooks + pw-mail-ips
  service + watchdog cron, all updated for the Jun-24-outage safety pattern)
- postfix 'outfilings' transport binds .90 / HELO mta01
- sender_dependent_default_transport_maps routes @filings.* -> outfilings; moved
  the randmap:{out05:} catch-all to default_transport=out05 so the sender map
  can win (recipient transport_maps outranks it otherwise)
- filings SPF updated to include .90

TEST RESULT: fresh IP fixed the reputation signal (Gmail error changed from
'low domain reputation' on .94 to 'likely unsolicited' cold-start on .90).
Non-Google (GMX/Microsoft) deliver fine; Gmail cold-start remains a slow wall.
Plan: CT campaign to non-Google first, warm .90, trickle Gmail over weeks.
This commit is contained in:
justin 2026-07-01 00:11:07 -05:00
parent cd374047da
commit 5d9306b75c
2 changed files with 52 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

41
infra/mail/filings-subdomain.md
View file

@ -42,10 +42,49 @@ v-add-dns-record justin performancewest.net filings TXT '"v=spf1 …"' '' '' no
- Live send → GMX accepted; OpenDKIM log: `DKIM-Signature field added (s=filings, d=filings.performancewest.net)`
- All 5 records resolve via `ns1.he.net`.
## Dedicated sending IP: .90 (mta01)
To also get a fresh *IP* reputation (not just domain), filings sends bind to
**207.174.124.90** (`mta01.performancewest.net`), isolated from the
reputation-damaged .94 trucking IP.
- **Interface:** `.90/23` bound on ens18, persisted 3 ways (the Jun-24-outage
pattern): `/etc/network/interfaces` up/down hooks + `pw-mail-ips.service` +
`pw-mail-ip-watchdog` cron (all now include .90).
- **PTR/FCrDNS:** `.90 -> mta01.performancewest.net -> .90` (already valid).
- **Postfix transport `outfilings`** (master.cf): binds `.90`, HELO
`mta01.performancewest.net`, 3s rate delay.
- **Routing:** `sender_dependent_default_transport_maps=hash:/etc/postfix/sender_transport`
maps `@filings.performancewest.net -> outfilings:`. NOTE: the old
`transport_maps = ..., randmap:{out05:}` catch-all was moved to
`default_transport = out05` so the sender map can win (recipient `transport_maps`
outranks the sender map, so a catch-all there would have forced everything to
out05/.94). Everything non-filings still egresses .94.
- **SPF** for filings now lists `.90` first: `v=spf1 ip4:207.174.124.90 ip4:.94 ip4:.107 -all`.
## Deliverability test results (2026-07-01, from .90)
| Receiver | Result |
|---|---|
| GMX (non-Google) | 250 accepted ✓ |
| Microsoft/Outlook | connection accepted (no reputation block) ✓ |
| **Gmail** | 550 "likely unsolicited mail" ✗ (cold-start, NOT reputation) |
**Key finding:** the fresh IP fixed the *reputation* signal — Gmail's error
changed from "very low reputation of the sending domain" (on .94) to "likely
unsolicited mail" (on .90). That is Gmail's **cold-start** block: it will not
accept cold outreach from a zero-history IP/domain on day one, independent of
auth (which all passes). Non-Google receivers deliver fine.
**Implication:** send the CT campaign to NON-Google recipients first (warm .90
with clean, low-bounce mail), and treat Gmail cold-start as a hard, slow wall —
only trickle Gmail in small batches over weeks once .90 has history + Postmaster
Tools signal.
## Warm-up plan (do NOT repeat the 34%-bounce mistake)
1. Send ONLY smtp_valid, non-Google leads first (CT clean pool ~3,106).
2. Start ~50–100/day, ramp over 2–3 weeks.
2. Start ~100/day, ramp over 2-3 weeks.
3. Watch Google Postmaster Tools (domain already verified) + DMARC rua reports.
4. Keep bounce <1% and complaints <0.1%; verify catch-alls at send time before
widening to the 38k CT catch-all reserve.

12
infra/network/interfaces
View file

@ -22,6 +22,18 @@ iface ens18 inet static
# (one IP at a time, days apart, only after Postmaster Tools shows green).
address 207.174.124.94/23
address 207.174.124.107/23
address 207.174.124.90/23 # filings subdomain (mta01) - fresh-reputation cold stream
# Secondary IPs: classic ifupdown only applies the FIRST address line, so
# bring these up explicitly (survives reboot; the bare address lines above
# are kept as documentation + for ifupdown2 compatibility).
up ip addr add 207.174.124.72/23 dev $IFACE || true
up ip addr add 207.174.124.94/23 dev $IFACE || true
up ip addr add 207.174.124.107/23 dev $IFACE || true
up ip addr add 207.174.124.90/23 dev $IFACE || true
down ip addr del 207.174.124.72/23 dev $IFACE || true
down ip addr del 207.174.124.94/23 dev $IFACE || true
down ip addr del 207.174.124.107/23 dev $IFACE || true
down ip addr del 207.174.124.90/23 dev $IFACE || true
gateway 207.174.124.1
# dns-* options are implemented by the resolvconf package, if installed
dns-nameservers 8.8.8.8 8.8.4.4