Gmail/Microsoft rejected send.performancewest.net mail for DOMAIN reputation
(not IP), so a fresh subdomain resets that to neutral. Fully separate from
send.* to avoid the trucking cold-send history. First use: the CT SOS
annual-report leads + a Gmail warm-up test.
- DNS (A/SPF/DKIM/DMARC/MX) published in HestiaCP -> HE slaves, all resolve.
- 2048-bit DKIM key (selector 'filings'); opendkim-testkey -> key OK.
- OpenDKIM key.table/signing.table/trusted.hosts updated + reloaded; live send
to GMX signed + accepted.
- Codified in the mail role's opendkim_signing_domains; setup doc in infra/mail.
Unattended kernel-upgrade reboot (Jun 24 04:04) left only .71 bound because
classic ifupdown applies just the first 'address' line. Postfix then failed to
bind .94/.107 ('Cannot assign requested address') and silently egressed from
.71 -- which is NOT in SPF (every fallback msg failed SPF) and is on RLR621 +
Trend ERS-QIL. ~37h of bypassed IP-warming + a near-zero sales day.
Fixes:
- /etc/network/interfaces: explicit up/down ip-addr hooks for .72/.94/.107
- pw-mail-ips.service: systemd oneshot re-binds IPs + flushes queue on boot
- pw-mail-ip-watchdog: */5 cron re-binds missing IPs + flushes, also catches
'Cannot assign' bind failures
- runbook: full incident writeup + reboot-test lesson
Host already remediated live; this commits the host artifacts + docs.
