#26: let the relay's SPF mechanism be configured, not guessed

SpfInclude derived the mechanism by reducing the relay hostname to its
organisational domain. That is unsound, and Brevo is the case that proves it:
the relay is smtp-relay.brevo.com, so the reduction yields
"include:brevo.com" - but brevo.com publishes the SPF of Brevo's own
corporate mail (Google Workspace and Zendesk). The sending ranges live at
spf.brevo.com.

Publishing the wrong include is worse than publishing none. It authorises
Google to send for the domain while leaving the relay unauthorised, so every
message the relay forwards fails SPF - and against the "-all" policy this
reconciler generates, is rejected rather than merely marked.

RELAY_SPF_INCLUDE now carries whatever the provider documents. A bare domain
gets the "include:" prefix; any other SPF term (ip4:, a:, mx:) passes through
untouched, since not every provider publishes an include. The old reduction
stays as a fallback for relays whose hostname does happen to match, because
publishing something plausible beats publishing nothing at all.

Caught before configuring a relay for real, by checking what brevo.com and
spf.brevo.com actually serve rather than trusting the heuristic.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/protocols/cmd/lambdamail-protocols/config.go

@@ -37,6 +37,10 @@ type config struct {
 	RelayPort int
 	RelayUser string
 	RelayPass string
+	// RelaySpfInclude overrides the SPF mechanism published for the relay.
+	// Providers document their own, and it is rarely the relay hostname's
+	// organisational domain - see RelayConfig.SpfInclude.
+	RelaySpfInclude string
 
 	// ArcSealEnabled adds an ARC set to accepted messages. It is off by
 	// default because it only earns its keep on a host that forwards mail
@@ -85,10 +89,11 @@ func loadConfig() config {
 		DnssecResolver:  envOrDefault("DNSSEC_RESOLVER", "1.1.1.1:53"),
 		MaxMessageBytes: int64(envInt("MAX_MESSAGE_BYTES", 52428800)),
 
-		RelayHost: os.Getenv("RELAY_HOST"),
-		RelayPort: envInt("RELAY_PORT", 587),
-		RelayUser: os.Getenv("RELAY_USER"),
-		RelayPass: os.Getenv("RELAY_PASS"),
+		RelayHost:       os.Getenv("RELAY_HOST"),
+		RelayPort:       envInt("RELAY_PORT", 587),
+		RelayUser:       os.Getenv("RELAY_USER"),
+		RelayPass:       os.Getenv("RELAY_PASS"),
+		RelaySpfInclude: os.Getenv("RELAY_SPF_INCLUDE"),
 
 		ArcSealEnabled: envBool("ARC_SEAL_ENABLED", false),
 

services/protocols/cmd/lambdamail-protocols/main.go

@@ -306,10 +306,11 @@ func watcherDegradedCheck(watcher *tlsprovider.AcmeCertWatcher, cfg config) func
 
 func relayConfig(cfg config) usecase.RelayConfig {
 	return usecase.RelayConfig{
-		Host:     cfg.RelayHost,
-		Port:     cfg.RelayPort,
-		Username: cfg.RelayUser,
-		Password: cfg.RelayPass,
+		Host:         cfg.RelayHost,
+		Port:         cfg.RelayPort,
+		Username:     cfg.RelayUser,
+		Password:     cfg.RelayPass,
+		SpfMechanism: cfg.RelaySpfInclude,
 	}
 }