- Shipped
- September 12, 2026 at 12:06 AM UTC
- Author
- Kamo
- Commit
- f8ed68b
Campaign mail now leaves through its own relay on k3m1 (egress 47.181.8.87) as hello.kamocrm.com, so complaints about bulk mail never touch the reputation of mail.kamocrm.com (47.181.8.84). - Plaintext relay on port 25 for EmailService only (NetworkPolicy); it accepts only @hello.kamocrm.com senders and refuses anything else with a 4xx, never a 5xx, because the campaign dispatcher suppresses on any 5xx. - An egress guard holds outbound delivery unless the pod's public address is 47.181.8.87, so bulk can never quietly leave as another IP. - A delivery-events sidecar reads the mail log and reports each campaign message's delivered / deferred / bounced / expired result to EmailService, joined by the X-Kamo-Ref header, which is stripped before delivery. Applied by hand for now: deploy-services.yml applies mail/ files by name and does not list these yet.