From 1885c884180d3233a00cf431563a28536b9e6e28 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 18 Oct 2026 13:26:20 +0200 Subject: [PATCH] MAS-WP-0003-T03: TEM relay live; service reply authenticated (SPF/DKIM/DMARC pass) Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 252470@bnt-lap001 Assistant-Session: ad628c8f-4be2-4979-94c9-76c7ed6f8241 --- workplans/MAS-WP-0003-provider-live-test.md | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/workplans/MAS-WP-0003-provider-live-test.md b/workplans/MAS-WP-0003-provider-live-test.md index 792cf69..c19b0ab 100644 --- a/workplans/MAS-WP-0003-provider-live-test.md +++ b/workplans/MAS-WP-0003-provider-live-test.md @@ -139,8 +139,16 @@ address and what envelope recipient arrives. the chroot lacked resolv.conf, which is why rDNS showed "unknown". Tested locally against the real TEM endpoint with dummy credentials: TLS verified, SASL rejected as expected. - Pending: TEM domain verification and DNS at IONOS (operator), Secret, - redeploy, then the reply send. + Relay login: OpenBao platform/suppliers/scaleway/mas-tem-relay, synced + by ExternalSecret `mas-relay` (ops-mason MASON-WP-0014, CCR-2026-0051). + The ExternalSecret needs explicit target metadata because of + reject-secret-last-applied. The first relay attempt got 535 from TEM + until the operator added the missing TEM IAM policy. + Reply leg 1 (2026-10-18): Gmail → `ticket!callback@` created ticket + GS-85QJ8WC09P. The service reply From + `ticket=GS-85QJ8WC09P@mas.coulomb.social` was accepted by TEM at 11:23:46Z + and arrived at Gmail with SPF pass, DKIM pass (d=mas.coulomb.social) and + DMARC pass. Gmail displays the `=` From address unmodified. ## Forwarding and list paths