- Verschifft
- 23. September 2026 um 18:18 UTC
- Autor
- Kamo
- Ausschuss
- 4f5f70e
Adds two endpoints alongside the existing SPF one, so an org's transactional mail (password resets, invitations, notifications) can carry a DKIM signature and the owner can see their DMARC posture: - GET /api/security/domains/{id}/dkim — generates a domain's DKIM key the first time it is asked for (never regenerated afterward, since swapping the key would break verification of anything already signed with the old one), checks whether the TXT record is published, and stores the verdict on **************** the same checked-state shape spf_verified already uses. - GET **************** — read-only. Every message Kamo sends as NoReply@{domain} uses that domain as both envelope sender and visible From, so DMARC's alignment check is already satisfied once SPF is done, whatever policy the customer has chosen. This only reports what is published (or suggests a starting record when nothing is) — it never asks for a change, since there is never one Kamo needs. **************** mirror SpfAdvisoryService's shape (a pure inspect(), a createLookup() seam for tests) and DkimAuthorizationService mirrors SpfAuthorizationService (persists the verdict, leaves it alone on a failed lookup). DkimDomainRepository is a plain JpaRepository the same way SpfDomainRepository is, for the same reason: it ships with one redeploy rather than a shared-library version bump. Depends on kamo-shared-library 5de57705 (OrgDomain's new dkim_* fields).