justin/new-site
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

mail: add filings.performancewest.net cold-outreach subdomain (fresh reputation)

Browse source 
Gmail/Microsoft rejected send.performancewest.net mail for DOMAIN reputation
(not IP), so a fresh subdomain resets that to neutral. Fully separate from
send.* to avoid the trucking cold-send history. First use: the CT SOS
annual-report leads + a Gmail warm-up test.

- DNS (A/SPF/DKIM/DMARC/MX) published in HestiaCP -> HE slaves, all resolve.
- 2048-bit DKIM key (selector 'filings'); opendkim-testkey -> key OK.
- OpenDKIM key.table/signing.table/trusted.hosts updated + reloaded; live send
  to GMX signed + accepted.
- Codified in the mail role's opendkim_signing_domains; setup doc in infra/mail.
This commit is contained in:
justin 2026-06-30 22:55:05 -05:00
parent 59f320ae0e
commit cd374047da
2 changed files with 59 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
infra/ansible/roles/mail/defaults/main.yml
View file

@ -25,6 +25,12 @@ opendkim_signing_domains:
selector: "{{ opendkim_selector }}"
- domain: "send.performancewest.net"
selector: "send"
# Dedicated cold-outreach subdomain for a FRESH domain reputation, separate from
# send.* (which carries the trucking cold-send reputation). Used for the CT
# annual-report campaign + Gmail warm-up test (2026-07). DNS (A/SPF/DKIM/DMARC/MX)
# published in HestiaCP; key validated with opendkim-testkey.
- domain: "filings.performancewest.net"
selector: "filings"
# Hosts OpenDKIM will SIGN for (vs verify). Must include the Docker bridge
# subnet so Listmonk container traffic is signed.

53
infra/mail/filings-subdomain.md Normal file
View file

@ -0,0 +1,53 @@
# filings.performancewest.net — dedicated cold-outreach subdomain
Set up 2026-07-01 to test whether a **fresh domain reputation** improves inbox
placement (Gmail/Microsoft explicitly rejected `send.performancewest.net` mail
for *domain* reputation, not IP). Kept fully separate from `send.*` so the
trucking cold-send history does not taint it.
First audience: the Connecticut SOS annual-report overdue leads (persona-fit
small businesses), warmed slowly.
## DNS records (published in HestiaCP → HE slaves; zone owner `justin`)
| Name | Type | Value |
|---|---|---|
| `filings` | A | `207.174.124.71` |
| `filings` | TXT (SPF) | `v=spf1 ip4:207.174.124.94 ip4:207.174.124.107 -all` |
| `_dmarc.filings` | TXT | `v=DMARC1; p=reject; adkim=r; aspf=r; pct=100; rua=mailto:dmarc@performancewest.net; ruf=mailto:dmarc@performancewest.net; fo=1` |
| `filings` | MX (10) | `co.carrierone.com.` |
| `filings._domainkey.filings` | TXT (DKIM) | `v=DKIM1; h=sha256; k=rsa; p=…` (2048-bit, selector `filings`) |
Add via HestiaCP CLI on `cp.carrierone.com` (ssh -p 22022 root@):
```
v-add-dns-record justin performancewest.net filings A 207.174.124.71 '' '' no 14400
v-add-dns-record justin performancewest.net filings TXT '"v=spf1 …"' '' '' no 14400
# …etc (see git history / the mail role)
```
## Server-side (prod mail host, 207.174.124.71)
- DKIM key: `/etc/opendkim/keys/filings.performancewest.net/filings.private`
(generated with `opendkim-genkey -b 2048 -d filings.performancewest.net -s filings`)
- `/etc/opendkim/key.table`:
`filings._domainkey.filings.performancewest.net filings.performancewest.net:filings:/etc/opendkim/keys/filings.performancewest.net/filings.private`
- `/etc/opendkim/signing.table`:
`*@filings.performancewest.net filings._domainkey.filings.performancewest.net`
- `/etc/opendkim/trusted.hosts`: `filings.performancewest.net`
- Codified in `infra/ansible/roles/mail/defaults/main.yml` (`opendkim_signing_domains`).
## Verification (all green 2026-07-01)
- `opendkim-testkey -d filings.performancewest.net -s filings` → **key OK**
- Live send → GMX accepted; OpenDKIM log: `DKIM-Signature field added (s=filings, d=filings.performancewest.net)`
- All 5 records resolve via `ns1.he.net`.
## Warm-up plan (do NOT repeat the 34%-bounce mistake)
1. Send ONLY smtp_valid, non-Google leads first (CT clean pool ~3,106).
2. Start ~50–100/day, ramp over 2–3 weeks.
3. Watch Google Postmaster Tools (domain already verified) + DMARC rua reports.
4. Keep bounce <1% and complaints <0.1%; verify catch-alls at send time before
widening to the 38k CT catch-all reserve.
5. Sender: `Performance West <noreply@filings.performancewest.net>`,
Reply-To `info@performancewest.net`.