The post room

Before the move, the Home’s mail was Exchange Online inside the tenant, and the mailbox was the recovery address for everything the Home had, from the registrar to the bank. There were two shared mailboxes, reception@ and volunteering@, with access that accumulated and never fell off. There were forwarding rules, one of which sent the Ledger Consortium’s mail from a departed staff member’s address to somewhere outside. SPF was present. DKIM was on for the primary domain. DMARC had sat at monitoring for eighteen months, producing reports that contained information nobody had read. The Fabulist Incident began with one email from fabulist-systerns.com, a Cyrillic letter standing in for a Latin one, which reached the IT coordinator’s inbox cleanly, was forwarded internally, and gave the attacker thirty-six hours. The scraps for this layer say what the Purple Lantern pages say: the address is the identity, the mailbox is furniture, and this furniture had been the whole house.

The post room, sorted

The first afternoon went on the rules. External auto-forwarding was blocked at the tenant, one setting, and the Consortium’s forwarded mail came back inside. The shared mailboxes got owners and an access list with a date on it. The DMARC reports were read, a month of them, and said what the Exchange page predicted: Exchange Online, Brevo, and two senders nobody recognised, one of which turned out to be the print company that produces the Adopt-a-Legend welcome packs. The policy went to p=quarantine and later to p=reject, and the record is the domain’s, in the Home’s zone, so it survived the change of provider that came next.

The landlord

The mail went to mailbox.org, operated by Heinlein Hosting GmbH of Berlin, on its own servers in redundant datacentres in Berlin, with custom domains on the business plans, calendars and address books, ISO 27001 certified and tested against BSI C5. The Standard plan is 4 euros a month per mailbox, which for the Home’s staff is a bill where there had been a grant. The finance team looked at the sum, looked at the grant’s terms on the tenant page, and paid it.

What mailbox.org takes from the Home is the domain’s MX, SPF, DKIM and DMARC records, all four in the Home’s zone at its registrar, none of them at mailbox.org. They are the public name’s records, on homeforbeasts.am. The identity provider and the landlords’ internal names are under the second name. Change the provider and the address stays, and that alone let the mail leave the tenant. The mechanics are the same as on the Purple Lantern pages and in the SPF, DKIM and DMARC runbooks.

The door it keeps

Whether mailbox.org takes an outside identity provider is not on its public pages, so the mail landlord keeps its own door. Every mailbox has its own password and second factor, and the administrator account is one of the four local administrators the identity page counts on. The identity provider’s absence changes nothing here. That is a cost as well as a safeguard. Staff have one more login than the tenant gave them, and the offboarding process has one more place to visit.

The landlord’s own name

One scrap came from the Purple Lantern naming page and applied here with a twist. The Home’s MX records point at hostnames under mailbox.org, and mailbox.org is a .org, a namespace run by Public Interest Registry of Reston, Virginia. The Home’s name sits in the city’s registry, but the road its mail takes to Berlin is signposted in an American one. If that registry ever stopped resolving the provider’s name, mail to the Home would stop with it, and the fix on the day is the same MX change as for any other loss of the provider. Posteo, for comparison, is a .de, run by DENIC eG from Frankfurt. So the provider’s own name went into the notes as one more line under the provider, and the git page of the first stack has the same line for Codeberg.

The fifth place

The identity provider, the file store, the chat and the mail each recover through a mailbox. If that mailbox is at mailbox.org, losing mailbox.org loses the way back into the other three, the loop the Purple Lantern email page draws for the registrar. So the recovery mailbox is at Posteo, Posteo e.K. of Berlin, on Posteo’s own domain, because Posteo does not offer custom domains at all. Its FAQ says why: it collects no user information, answers requests from authorities for user information in the negative, and a custom domain would have to be registered to a name and address. A recovery address that cannot be on the Home’s domain is a recovery address that survives the Home’s domain. Posteo also says it is not a processor under the GDPR and signs no processing agreement. A mailbox whose only job is to receive four reset links a decade does not need one.

Brevo, which stayed

High-volume mail to the 200,000 members goes through Brevo, and it still does. Brevo is Sendinblue SAS of Paris, and its terms list its infrastructure sub-processors: OVH in France, Google Cloud Platform with servers in Belgium under the EU-US framework and standard contractual clauses, and Cloudflare in the USA for content delivery and the firewall. So the letters telling thirty thousand sponsors how their griffin is getting on pass a French company, an American cloud’s Belgian servers and an American network on the way. That is written down as the campaign layer’s open item. The Home’s mail, the kind with a reply address, does not touch any of it.

Posted

                    the Home's zone, at its registrar
                              │
                 ┌────────────┼────────────┐
                MX           SPF        DKIM, DMARC
                 │
           mailbox.org, Berlin ── own door, own second factor
                 │
        ┌────────┴────────┐
    staff mail        shared mailboxes, with owners

   campaigns: Brevo, Paris (OVH, Google Cloud in Belgium, Cloudflare)

   recovery for all four landlords: a Posteo address, Berlin, on Posteo's domain

Forwarding is blocked, DMARC is at reject, and the campaign sender is kept with its American underside named.

What could go wrong?

  • mailbox.org suspends the account, and the MX records change to another provider within a day, at the same address, with the registrar and the bank still writing to it.

  • The Posteo address is forgotten, and the four reset links a decade arrive at a mailbox nobody checks.

  • The registry behind .org stops resolving the provider’s name, and the Home’s mail stops until the MX records point somewhere else, while the Home’s own domain never noticed.

  • Brevo’s Cloudflare or Google Cloud stops serving Brevo, and the monthly letters to the sponsors stop until Brevo or the Home finds another road.

  • A staff member’s mailbox.org password and second factor are phished together, which the identity provider would have caught and the mail landlord’s own door does not.

The mail provider is gone, what now? The address exists because the domain exists. The MX records point at another provider, the archive is at home, and info@ receives again by the end of the day. The recovery links for the identity provider, the files and the chat go to Posteo and always did. What does not come back is the old mail that was not exported, so the export runs monthly and lives with the backups.

Nanny Ogg writes to all her children, and the letters that count go by hand with a grandchild, because the post can be read by anyone with a kettle.