Two workstreams wrapped. Summary + what's still on your plate. 1) [email protected] — LIVE, locked tight - Licensed mailbox, sign-in disabled, IMAP/POP/OWA/SMTP-auth/ActiveSync/MAPI all off (same hardening as [email protected]) - Transport rule priority 0: allow INBOUND only from SenderDomainIs=twilio.com → StopRuleProcessing - Transport rule priority 1: reject everything else to [email protected] ("only allowlisted vendors") - Transport rule: OUTBOUND from [email protected] blocked entirely — receive-only by policy - When you want to add another vendor (SendGrid, Stripe, GitHub, etc.), email me: "add vendor X to [email protected]" and I'll update the allow rule Agent does NOT currently poll [email protected]. Ready to wire when you're good with the security posture — it would classify vendor mail the same way as your own inboxes (OTPs flagged, billing flagged, etc.). Say "poll [email protected]" to enable. Twilio status: your bought number's webhook POSTs will start to pass allowlist as soon as you add twilio.com to the allowlist (done) AND send me TWILIO_ACCOUNT_SID / TWILIO_AUTH_TOKEN / TWILIO_PHONE_NUMBER / your mobile in E.164. Still waiting on those to finish the SMS setup. 2) DNS PHISHING AUDIT — 15 zones checked Strong points: - All 15 zones have DMARC records, all policies match expected posture - All active-sending zones ending in -all (hard fail) now - DMARC rua reporting going to CF Email Security dashboard for all Fixes applied tonight: ✓ sydnee.ai — M365 DKIM ENABLED + CNAMEs published. This was the biggest gap: sydnee.ai is at p=none-monitoring for active outbound but was sending unsigned (DKIM=none at receivers). Spoof window closed. ✓ verdantridge.capital — SPF tightened ~all → -all (parked, CF Email Routing include preserved) ✓ vridge.capital — SPF tightened ~all → -all (parked, CF Email Routing include preserved) Fixes blocked on tenant-verification: ✗ sydneex.com — cannot enable M365 DKIM; domain not verified on KanexPro tenant ✗ radiantunite.com — same; domain "added but not verified" per 2026-04-17 tenant state memo Both are low-urgency since they're at p=none and SPF hard-fails external spoofs. To close fully: verify each domain on tenant (Graph POST /domains + TXT proof, like we did for kanex.ai). ~10 min per domain. Say "verify sydneex.com and radiantunite.com on tenant" and I'll do both. WHY YOU MIGHT STILL BE GETTING PHISHING The audit checks OUTBOUND protections (your own domains being spoofed by others). Those are solid now except the 2 unverified. What it does NOT check is INBOUND phishing — attackers sending FROM lookalike domains (kanexpro-com.net, kanex-ai-support.com, etc.) TO your mailboxes. That's classifier + phishing.py territory. Current defenses: - M365 Anti-phishing policies (tenant-wide; I can harden via PowerShell) - kanex-ai's app/phishing.py heuristics (display-name impersonation, protected-domain spoof, subject patterns) - allowlist / blocklist / tenant_block via Kanex Ai1 If you're still seeing phish leaking to your Inbox (not Junk), forward one to [email protected] and ask Kanex Ai1 to "investigate" — it'll pull the original's true headers and identify the real sender domain. You can then block that domain tenant-wide in one APPROVE. 3) DMARC PROMOTION CANDIDATES (next step when rua reports are clean) From the audit, zones at p=none + sending actively + now with DKIM enabled: - kanex.ai (already DKIM-enabled, could go to p=reject — but already at reject, good) - kanexpro.com (DKIM enabled, still p=none) — primary candidate to go p=quarantine then p=reject after 2 weeks rua review - kanex.com (DKIM enabled, p=none) — same - sydnee.ai (just enabled DKIM tonight) — should NOT promote until 7+ days of clean rua reports - flareprints.com (DKIM enabled, p=none) — promote candidate Tell me when you want to promote kanexpro.com + kanex.com to p=quarantine (I'll do both with one APPROVE; reversible). 4) TODOS STILL OPEN ON YOUR END - TWILIO_ACCOUNT_SID / AUTH_TOKEN / phone / mobile — send when ready → SMS live - Algo VPS SSH restore (via your hosting console) → unlocks live reboot tool - GitHub PAT (fine-grained, push to kanex1/kanex-ai) → migrate dev VPS to git clone → code_task gets full auto-deploy