src/osm-wiki.js

   1 D(DOMAIN, REGISTRAR, DnsProvider(PROVIDER),
   2
   3   // Publish CAA records indicating that only letsencrypt and globalsign (Fastly) should issue certificates
   4
   5   CAA_BUILDER({
   6     label: "@",
   7     ttl: "1h",
   8     iodef: "mailto:hostmaster@openstreetmap.org",
   9     issue: [
  10       "letsencrypt.org",
  11       "globalsign.com",   // Used by Fastly for CDN certificates
  12     ],
  13     issuewild: [
  14       "letsencrypt.org",
  15       "globalsign.com",   // Used by Fastly for CDN certificates
  16     ],
  17   }),
  18
  19   // Mail service
  20
  21   MX("@", 10, QUALIFY("a.mx")),
  22
  23   A("a.mx", IPV4["fafnir.he"]),
  24   AAAA("a.mx", IPV6["fafnir.he"]),
  25   A("mail", IPV4["fafnir.he"]),
  26   AAAA("mail", IPV6["fafnir.he"]),
  27   A("mta-sts", IPV4["fafnir.he"]),
  28   AAAA("mta-sts", IPV6["fafnir.he"]),
  29
  30   // Delegate SPF policy to the main domain
  31
  32   SPF_BUILDER({
  33     label: "@",
  34     parts: [
  35       "v=spf1",
  36       "include:openstreetmap.org",      // main openstreetmap.org spf record
  37       "-all"
  38     ]
  39   }),
  40
  41   // Publish DMARC report-only policy
  42
  43   DMARC_BUILDER({
  44     policy: "none",
  45     rua: [
  46       "mailto:openstreetmap-d@dmarc.report-uri.com"
  47     ],
  48     failureOptions: 1
  49   }),
  50
  51   // Announce MTA-STS policy and TLSRPT policy for error reports
  52
  53   TXT("_mta-sts", "v=STSv1; id=202001291805Z"),
  54   TXT("_smtp._tls", "v=TLSRPTv1; rua=mailto:openstreetmap-d@tlsrpt.report-uri.com"),
  55
  56   // Fastly cert domain ownership confirmation
  57
  58   TXT("@", "_globalsign-domain-verification=ps00GlW1BzY9c2_cwH_pFqRkvzZyaCVZ-3RLssRG6S"),
  59   TXT("@", "_globalsign-domain-verification=W0buKB5ZmL-VwwHw2oQyQImk3I1q3hSemf2qmB1hjP"),
  60
  61   osm_web_service("wiki", "konqi.he"),
  62   osm_web_service("www", "konqi.he"),
  63   osm_web_service("@", "konqi.he")
  64
  65 );