From eb18c1603c2d42cce688a758cf2a69386a0e4f6a Mon Sep 17 00:00:00 2001
From: Rasmus Wejlgaard <pez@pez.sh>
Date: Sat, 28 Mar 2026 20:45:44 +0000
Subject: [PATCH] update SPF record: replace protonmail with poste.io mail
 server

PESO-77

- replace include:_spf.protonmail.ch with ip4:167.235.134.154 and ip6:2a01:4f8:1c1e:9c53::1 (nuremberg-a / mail.pez.sh)
- tighten from ~all (softfail) to -all (hardfail)
---
 terraform/cloudflare_dns.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/terraform/cloudflare_dns.tf b/terraform/cloudflare_dns.tf
index 23bc04b..d31f78c 100644
--- a/terraform/cloudflare_dns.tf
+++ b/terraform/cloudflare_dns.tf
@@ -432,7 +432,7 @@ resource "cloudflare_dns_record" "root-txt-spf" {
   zone_id = cloudflare_zone.pez-sh.id
   name    = "@"
   type    = "TXT"
-  content = "v=spf1 include:_spf.protonmail.ch ~all"
+  content = "v=spf1 ip4:167.235.134.154 ip6:2a01:4f8:1c1e:9c53::1 -all"
   ttl     = 1
 }