Ops cleanup after relay / inbound unblock (2026-08-05)

Code changes make route provisioning idempotent and gate domain active on provider-verified identities. These production steps still need a human.

1. Prune duplicate Mailgun routes

MAILGUN_API_KEY=… node scripts/ops-mailgun-route-dedupe.mjs g0rentals.com --dry-run
MAILGUN_API_KEY=… node scripts/ops-mailgun-route-dedupe.mjs g0rentals.com

Or rely on the next relay.reconcile cron / tenant Re-check ESP, which calls list-first ensureInbound and deletes extras.

2. Rotate the Mailgun API key

The key was pasted into chat. Create a new key in Mailgun, update the Coldfeet admin relay account, then revoke the old key.

3. DNS on g0rentals.com

Remove leftover 30 g0rentals-com.mail.protection.outlook.com MX (scanning bypass).
Republish Coldfeet DKIM at cf-g0rentals._domainkey to match the wizard value.

4. Platform mail host alignment

mail.otpvalidateendpoint.com currently disagrees with itself:

Record	Value
A	`84.32.34.127`
SPF	`ip4:84.32.83.202`
PTR `84.32.34.127`	none
PTR `84.32.83.202`	`mfaverificationmethod.com`

Every tenant SPF includes include:mail.otpvalidateendpoint.com. Align A, SPF, and PTR with the real egress source IP(s) before direct-MX outbound can pass SPF.

5. Bootstrap identity refresh

On API boot, EgressRelayIdentityService refreshes up to 200 bound identities (unless RELAY_IDENTITY_BOOTSTRAP_REFRESH=0). Admins can also:

POST /api/v1/admin/egress/relay-identities/refresh-all