Email authentication can fail later without DNS changes, due to SPF lookup limits and DKIM drift

·9 views

A one-time SPF and DKIM setup is only a snapshot, since authentication results can change even when published records stay the same. SPF permits at most 10 DNS-querying mechanisms per evaluation, so a provider adding its own include can push a domain over the limit, causing a permerror and an SPF failure. DKIM can break silently if a CNAME-delegated selector is removed during DNS cleanup, leaving mail from that sender failing or unsigned. Newly added third-party tools that send on a company's behalf may go unnoticed under a p=none policy but cause mail to be spammed or bounced once the policy is tightened. The article recommends recounting SPF lookups after provider changes and regularly reviewing aggregate reports sent to the rua address before enforcing stricter policies.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Walk-Forward Testing Explained: Two Versions With Different Rigor

Walk-forward analysis is widely regarded as a gold-standard method for validating trading strategies, but the term covers two distinct approaches. The classic method, introduced by Robert Pardo in 1992, optimizes parameters on one period, tests them unchanged on the following period, and rolls the window forward, stitching the out-of-sample segments into a composite curve. A stricter variant, purged walk-forward, also removes training data near test boundaries and adds embargo periods to prevent information leakage across folds. The article argues that vendors claiming walk-forward validation should specify which version they used and whether their verdict depends on it. It also recommends using at least five folds across varied regimes, examining performance trends across folds rather than averages, avoiding re-tuning on out-of-sample data, and following walk-forward testing with forward paper trading.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Keeping AI Products Online During Model Provider Outages With Gateways and Fallbacks

A guide published by Control Plane, a cloud platform vendor, recommends placing an OpenAI-compatible gateway in front of all model calls to keep AI products running when a provider fails. It advises configuring fallback chains that move from the same model in another region to an equivalent model from a different provider, then to a self-hosted open-weight model. The article lists common failure modes, including full outages, elevated error rates, rate limits, latency spikes, regional capacity limits, broken streams, and model deprecations. It also recommends running the gateway and agent services across multiple regions so the resilience layer does not become a single point of failure. Testing with blocked providers and injected errors is suggested to measure fallback speed and output quality.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Kubernetes Secrets Distribute Credentials but Do Not Provide Key Custody

A Kubernetes Secret is well suited to delivering sensitive configuration to workloads, but it is not designed to answer security questions such as identity, authorization, or key custody. Problems arise when one Secret ends up representing identity, enrollment state, rotation, and tenant context all at once, making failures hard to diagnose. The article argues for separating distribution, private-key custody, workload identity, and authorization, so that a private key is never exported to the caller. It also describes a candidate enrollment contract that requires enrolled workload credentials to live in encrypted, CRD-backed custody with a non-exporting signing interface, while forbidding Secret volumes and similar injection methods. The author notes that this contract is not yet qualified and that migration work remains open.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Running Apps Across Regions: Routing, Databases, and Failover for Stateful Workloads

The guide explains that multi-region deployments rely on deploying the same stateless services from one definition to every region, with a health-checked global routing layer sending users to the nearest healthy region. Each database needs its own data topology, such as a single primary with replicas, multi-primary, or distributed SQL, chosen according to tolerance for write latency and data loss. Stateless services fail over through routing changes, whereas databases require promotion steps that must be designed and tested in advance. Automatic failover depends on quorum, so two locations tolerate no location loss, three tolerate one, and five tolerate two. The article notes it is published by Control Plane, which offers a multi-location platform and database templates.

0 comments Read more at DEV Community