Move MX record to its own subdomain

.github/workflows/staging-ipv4.testrun.org-default.zone

@@ -19,3 +19,4 @@ $TTL 300
 mta-sts.staging-ipv4.testrun.org.    CNAME   staging-ipv4.testrun.org.
 iroh.staging-ipv4.testrun.org.       CNAME   staging-ipv4.testrun.org.
 www.staging-ipv4.testrun.org.        CNAME   staging-ipv4.testrun.org.
+mx.staging-ipv4.testrun.org.         CNAME   staging-ipv4.testrun.org.

.github/workflows/staging.testrun.org-default.zone

@@ -19,4 +19,5 @@ $TTL 300
 mta-sts.staging2.testrun.org.    CNAME   staging2.testrun.org.
 iroh.staging2.testrun.org.       CNAME   staging2.testrun.org.
 www.staging2.testrun.org.        CNAME   staging2.testrun.org.
+mx.staging2.testrun.org.         CNAME   staging2.testrun.org.
 

CHANGELOG.md

@@ -65,6 +65,8 @@
 - fix Dovecot quota_max_mail_size to use max_message_size config value
   ([#438](https://github.com/deltachat/chatmail/pull/438))
 
+- Move MX record to its own subdomain
+  ([#403](https://github.com/deltachat/chatmail/pull/403))
 
 ## 1.4.1 2024-07-31
 

cmdeploy/src/cmdeploy/__init__.py

@@ -616,7 +616,12 @@ def deploy_chatmail(config_path: Path, disable_mail: bool) -> None:
     deploy_iroh_relay(config)
 
     # Deploy acmetool to have TLS certificates.
-    tls_domains = [mail_domain, f"mta-sts.{mail_domain}", f"www.{mail_domain}"]
+    tls_domains = [
+        mail_domain,
+        f"mta-sts.{mail_domain}",
+        f"www.{mail_domain}",
+        f"mx.{mail_domain}",
+    ]
     deploy_acmetool(
         domains=tls_domains,
     )

cmdeploy/src/cmdeploy/chatmail.zone.j2

@@ -7,10 +7,11 @@
 {% if AAAA %}
 {{ mail_domain }}.                   AAAA  {{ AAAA }}
 {% endif %}
-{{ mail_domain }}.                   MX 10 {{ mail_domain }}.
+{{ mail_domain }}.                   MX 10 mx.{{ mail_domain }}.
 _mta-sts.{{ mail_domain }}.          TXT "v=STSv1; id={{ sts_id }}"
 mta-sts.{{ mail_domain }}.           CNAME {{ mail_domain }}.
 www.{{ mail_domain }}.               CNAME {{ mail_domain }}.
+mx.{{ mail_domain }}.                CNAME {{ mail_domain }}.
 {{ dkim_entry }}
 
 ;

cmdeploy/src/cmdeploy/nginx/mta-sts.txt.j2

@@ -1,4 +1,4 @@
 version: STSv1
 mode: enforce
-mx: {{ config.domain_name }}
+mx: mx.{{ config.domain_name }}
 max_age: 2419200