infra(mail): remove 18 dormant snowshoe IPs from postfix + host

Consolidate the outbound mail footprint to match the SPF intent (already
trimmed to .94/.107 on 2026-06-19). A 20-IP sending footprint reads as
snowshoe spam to receivers and was contributing to domain-reputation
throttling (Microsoft 451 4.7.500, Gmail low-reputation).

Removed from /etc/postfix/master.cf: transports yahooslow, out02-04,
out06-20, rehab02-04, HC submission ports 2527/2528, hcout2/hcout3.
Removed from /etc/network/interfaces (+ live ip addr del): host bindings
.90-.93, .95-.106, .108-.109. Kept: .94 (trucking/out05), .107 (HC/hcout1),
.71/.72 (infra).

Verified live: postfix check OK, both streams still status=sent post-change,
SSH session on .71 unaffected, transport_maps still routes via out05.

Snapshots: infra/postfix/live-snapshots/master.cf, infra/network/interfaces.
Live backups on server: /root/{master.cf,interfaces}.bak_snowshoe_*.

docs/deliverability.md

@@ -87,9 +87,19 @@ any UI/test send that doesn't set From explicitly.
 | **Trucking** (listmonk) | **207.174.124.94** | mta05.performancewest.net | listmonk -> :25 -> `randmap:{out05:}` |
 | **Healthcare** (listmonk-hc) | **207.174.124.107** | hcmta01.performancewest.net | listmonk-hc SMTP server 1 -> :2526 -> hcout1 |
 | Transactional / verification | 207.174.124.71 + co.carrierone.com (.15) | perfwest | default `smtp_bind_address` (.71) + :587 relay (.15) |
-| Yahoo/AOL trickle | 207.174.124.90 | mta01 | `yahooslow` transport (hash:transport) |
+| Removed 2026-06-23 (snowshoe cleanup) | .90-.93, .95-.106, .108-.109 | mta01-04/06-17, hcmta02-03 | transports + host IP bindings DELETED |
-| Retired (torched May 30-31) | .91 / .92 / .93 | mta02-04 | rehab02-04 — **`pw-ip-rehab` cron DISABLED 2026-06-19** |
+
-| Dormant (re-expand later) | .95-.105, .108-.109 | mta06-17, hcmta02-03 | disabled |
+**Snowshoe IP cleanup (2026-06-23):** the 18 dormant sending IPs (.90-.93,
+.95-.106, .108-.109) were fully removed from BOTH postfix (`master.cf`
+transports `yahooslow`/`out02-04`/`out06-20`/`rehab02-04`/`2527`/`2528`/
+`hcout2`/`hcout3`) AND the host (`/etc/network/interfaces` + live `ip addr del`).
+Only the two warm sending IPs (.94 trucking, .107 HC) plus infra (.71/.72)
+remain bound. A 20-IP footprint reads as snowshoe spam and was hurting domain
+reputation; the SPF was already trimmed to .94/.107 on 2026-06-19, so this just
+makes the host/postfix match the SPF intent. Verified live: `postfix check` OK,
+both streams still `status=sent` post-change, SSH unaffected. Reference snapshots
+committed at `infra/postfix/live-snapshots/master.cf` + `infra/network/interfaces`
+(live backups `/root/master.cf.bak_snowshoe_*` + `/root/interfaces.bak_snowshoe_*`).
 
 **Root SPF (trimmed 2026-06-19):** `v=spf1 a mx ip4:207.174.124.15
 ip4:207.174.124.94 ip4:207.174.124.107 -all` — `a`=.71, `mx`=co.carrierone.com(.15),

infra/network/interfaces

@@ -0,0 +1,28 @@
+# This file describes the network interfaces available on your system
+# and how to activate them. For more information, see interfaces(5).
+
+source /etc/network/interfaces.d/*
+
+# The loopback network interface
+auto lo
+iface lo inet loopback
+
+# The primary network interface
+allow-hotplug ens18
+iface ens18 inet static
+	address 207.174.124.71/23
+	address 207.174.124.72/23
+	# Mail sending IPs (consolidated 2026-06-23 to remove snowshoe footprint):
+	#   .94  = mta05  -> trucking stream (out05)
+	#   .107 = hcmta01 -> healthcare HOT stream (hcout1)
+	# The dormant rotation pool (.90-.93, .95-.106, .108-.109 / mta01-20,
+	# hcmta02-03) was removed: a 20-IP footprint reads as snowshoe spam and
+	# hurt domain reputation. To re-expand later, re-add the address lines
+	# here + the postfix transports (master.cf) + BOTH SPF records, SLOWLY
+	# (one IP at a time, days apart, only after Postmaster Tools shows green).
+	address 207.174.124.94/23
+	address 207.174.124.107/23
+	gateway 207.174.124.1
+	# dns-* options are implemented by the resolvconf package, if installed
+	dns-nameservers 8.8.8.8 8.8.4.4
+	dns-search performancewest.net

infra/postfix/live-snapshots/master.cf

@@ -0,0 +1,194 @@
+#
+# Postfix master process configuration file.  For details on the format
+# of the file, see the master(5) manual page (command: "man 5 master" or
+# on-line: https://www.postfix.org/master.5.html).
+#
+# Do not forget to execute "postfix reload" after editing this file.
+#
+# ==========================================================================
+# service type  private unpriv  chroot  wakeup  maxproc command + args
+#               (yes)   (yes)   (no)    (never) (100)
+# ==========================================================================
+smtp      inet  n       -       y       -       -       smtpd
+#smtp      inet  n       -       y       -       1       postscreen
+#smtpd     pass  -       -       y       -       -       smtpd
+#dnsblog   unix  -       -       y       -       0       dnsblog
+#tlsproxy  unix  -       -       y       -       0       tlsproxy
+# Choose one: enable submission for loopback clients only, or for any client.
+#127.0.0.1:submission inet n -   y       -       -       smtpd
+#submission inet n       -       y       -       -       smtpd
+#  -o syslog_name=postfix/submission
+#  -o smtpd_forbid_unauth_pipelining=no
+#  -o smtpd_tls_security_level=encrypt
+#  -o smtpd_sasl_auth_enable=yes
+#  -o smtpd_tls_auth_only=yes
+#  -o local_header_rewrite_clients=static:all
+#  -o smtpd_hide_client_session=yes
+#  -o smtpd_reject_unlisted_recipient=no
+#     Instead of specifying complex smtpd_<xxx>_restrictions here,
+#     specify "smtpd_<xxx>_restrictions=$mua_<xxx>_restrictions"
+#     here, and specify mua_<xxx>_restrictions in main.cf (where
+#     "<xxx>" is "client", "helo", "sender", "relay", or "recipient").
+#  -o smtpd_client_restrictions=
+#  -o smtpd_helo_restrictions=
+#  -o smtpd_sender_restrictions=
+#  -o smtpd_relay_restrictions=
+#  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
+#  -o milter_macro_daemon_name=ORIGINATING
+# Choose one: enable submissions for loopback clients only, or for any client.
+#127.0.0.1:submissions inet n  -       y       -       -       smtpd
+#submissions     inet  n       -       y       -       -       smtpd
+#  -o syslog_name=postfix/submissions
+#  -o smtpd_forbid_unauth_pipelining=no
+#  -o smtpd_tls_wrappermode=yes
+#  -o smtpd_sasl_auth_enable=yes
+#  -o local_header_rewrite_clients=static:all
+#  -o smtpd_hide_client_session=yes
+#  -o smtpd_reject_unlisted_recipient=no
+#     Instead of specifying complex smtpd_<xxx>_restrictions here,
+#     specify "smtpd_<xxx>_restrictions=$mua_<xxx>_restrictions"
+#     here, and specify mua_<xxx>_restrictions in main.cf (where
+#     "<xxx>" is "client", "helo", "sender", "relay", or "recipient").
+#  -o smtpd_client_restrictions=
+#  -o smtpd_helo_restrictions=
+#  -o smtpd_sender_restrictions=
+#  -o smtpd_relay_restrictions=
+#  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
+#  -o milter_macro_daemon_name=ORIGINATING
+#628       inet  n       -       y       -       -       qmqpd
+pickup    unix  n       -       y       60      1       pickup
+cleanup   unix  n       -       y       -       0       cleanup
+qmgr      unix  n       -       n       300     1       qmgr
+#qmgr     unix  n       -       n       300     1       oqmgr
+tlsmgr    unix  -       -       y       1000?   1       tlsmgr
+rewrite   unix  -       -       y       -       -       trivial-rewrite
+bounce    unix  -       -       y       -       0       bounce
+defer     unix  -       -       y       -       0       bounce
+trace     unix  -       -       y       -       0       bounce
+verify    unix  -       -       y       -       1       verify
+flush     unix  n       -       y       1000?   0       flush
+proxymap  unix  -       -       n       -       -       proxymap
+proxywrite unix -       -       n       -       1       proxymap
+smtp      unix  -       -       y       -       -       smtp
+relay     unix  -       -       y       -       -       smtp
+        -o syslog_name=${multi_instance_name?{$multi_instance_name}:{postfix}}/$service_name
+#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
+showq     unix  n       -       y       -       -       showq
+error     unix  -       -       y       -       -       error
+retry     unix  -       -       y       -       -       error
+discard   unix  -       -       y       -       -       discard
+local     unix  -       n       n       -       -       local
+virtual   unix  -       n       n       -       -       virtual
+lmtp      unix  -       -       y       -       -       lmtp
+anvil     unix  -       -       y       -       1       anvil
+scache    unix  -       -       y       -       1       scache
+postlog   unix-dgram n  -       n       -       1       postlogd
+#
+# ====================================================================
+# Interfaces to non-Postfix software. Be sure to examine the manual
+# pages of the non-Postfix software to find out what options it wants.
+#
+# Many of the following services use the Postfix pipe(8) delivery
+# agent.  See the pipe(8) man page for information about ${recipient}
+# and other message envelope options.
+# ====================================================================
+#
+# maildrop. See the Postfix MAILDROP_README file for details.
+# Also specify in main.cf: maildrop_destination_recipient_limit=1
+#
+#maildrop  unix  -       n       n       -       -       pipe
+#  flags=DRXhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
+#
+# ====================================================================
+#
+# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
+#
+# Specify in cyrus.conf:
+#   lmtp    cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
+#
+# Specify in main.cf one or more of the following:
+#  mailbox_transport = lmtp:inet:localhost
+#  virtual_transport = lmtp:inet:localhost
+#
+# ====================================================================
+#
+# Cyrus 2.1.5 (Amos Gouaux)
+# Also specify in main.cf: cyrus_destination_recipient_limit=1
+#
+#cyrus     unix  -       n       n       -       -       pipe
+#  flags=DRX user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
+#
+# ====================================================================
+#
+# Old example of delivery via Cyrus.
+#
+#old-cyrus unix  -       n       n       -       -       pipe
+#  flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
+#
+# ====================================================================
+#
+# See the Postfix UUCP_README file for configuration details.
+#
+#uucp      unix  -       n       n       -       -       pipe
+#  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
+#
+# ====================================================================
+#
+# Other external delivery methods.
+#
+#ifmail    unix  -       n       n       -       -       pipe
+#  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
+#
+#bsmtp     unix  -       n       n       -       -       pipe
+#  flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -f $sender $nexthop $recipient
+#
+#scalemail-backend unix -       n       n       -       2       pipe
+#  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store
+#  ${nexthop} ${user} ${extension}
+#
+#mailman   unix  -       n       n       -       -       pipe
+#  flags=FRX user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
+#  ${nexthop} ${user}
+
+# Slow transport for Gmail/Microsoft/Yahoo (strict rate limiting during warmup)
+slow      unix  -       -       n       -       2       smtp
+  -o smtp_destination_rate_delay=5s
+  -o smtp_destination_concurrency_limit=2
+
+# Pipe bounce notifications to Listmonk
+listmonk-bounce unix  -       n       n       -       -       pipe
+  flags=FDq user=nobody argv=/usr/local/bin/listmonk-bounce-handler.sh
+
+# === Trucking sending transport (consolidated to ONE warm IP) ===
+# out05 = .94 / mta05. The multi-IP snowshoe rotation was removed
+# 2026-06-23 (snowshoe footprint hurt domain reputation). To re-expand
+# later, re-add transports here + host IPs + SPF, SLOWLY.
+out05 unix - - n - - smtp
+  -o smtp_bind_address=207.174.124.94
+  -o smtp_helo_name=mta05.performancewest.net
+  -o syslog_name=postfix/out05
+  -o smtp_destination_concurrency_limit=2
+  -o smtp_destination_rate_delay=2s
+  -o smtp_destination_recipient_limit=2
+
+# === Healthcare HOT stream ===
+# Consolidated to ONE warm IP 2026-06-23: port 2526 -> hcout1 (.107).
+# Ports 2527/2528 + hcout2/hcout3 (.108/.109) removed (snowshoe). The
+# content_filter forces 2526 onto hcout1, overriding the global trucking
+# transport_maps so hc mail never uses the trucking IP.
+2526      inet  n       -       y       -       -       smtpd
+  -o syslog_name=postfix/hcsubmit107
+  -o smtpd_client_restrictions=permit_mynetworks,reject
+  -o smtpd_recipient_restrictions=permit_mynetworks,reject_unauth_destination
+  -o smtpd_helo_required=no
+  -o content_filter=hcout1:
+hcout1 unix - - y - - smtp
+  -o smtp_bind_address=207.174.124.107
+  -o smtp_helo_name=hcmta01.performancewest.net
+  -o syslog_name=postfix/hcout1
+  -o smtp_destination_concurrency_limit=10
+  -o smtp_destination_rate_delay=0s
+  -o smtp_destination_recipient_limit=20
+
+sinktest   unix  -       -       n       -       -       smtp
+    -o smtp_send_xforward_command=no