; Route53 DNS template for KumoMTA on AWS
; Replace example.com, mail1.example.com, and 203.0.113.10 with your values
; Context: production sending domain with self-hosted MTA + optional SES hybrid MAIL FROM

; SPF (TXT) — keep DNS lookup count under 10
example.com. 300 IN TXT "v=spf1 ip4:203.0.113.10 ip4:203.0.113.11 -all"

; DKIM selector (TXT) — replace p= with your public key
k1._domainkey.example.com. 300 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

; DMARC — start p=none for visibility, tighten to quarantine/reject after alignment confidence
_dmarc.example.com. 300 IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-agg@example.com; ruf=mailto:dmarc-forensic@example.com; fo=1; adkim=s; aspf=s; pct=100"

; Custom MAIL FROM / bounce domain (optional SES hybrid)
bounce.example.com. 300 IN MX 10 feedback-smtp.us-east-1.amazonses.com.
bounce.example.com. 300 IN TXT "v=spf1 include:amazonses.com -all"

; MTA host A record (Elastic IP)
mail1.example.com. 300 IN A 203.0.113.10

; PTR (reverse DNS) — request via AWS support for each Elastic IP
; 10.113.0.203.in-addr.arpa. 300 IN PTR mail1.example.com.