# T6 — Auth deliverability evidence

Date: 2026-07-27
Project: `multideal-49eff`
Sending domain: `multi.deal` (`noreply@multi.deal` in `apps/web/.env.example`)

Secrets are redacted. No live secret value is present in this dossier.

## Checks

### 1. SPF — PASS

Command:

```sh
dig TXT multi.deal +noall +answer
dig TXT send.multi.deal +noall +answer
```

Actual output:

```text
multi.deal.          300 IN TXT "v=spf1 include:_spf.mx.cloudflare.net ~all"
multi.deal.          300 IN TXT "zoho-verification=<REDACTED>"
multi.deal.          300 IN TXT "brevo-code:<REDACTED>"
send.multi.deal.     3600 IN TXT "v=spf1 include:amazonses.com ~all"
```

`send.multi.deal` is the Resend custom return-path SPF record.

### 2. DKIM — PASS

Command:

```sh
dig TXT resend._domainkey.multi.deal +noall +answer
```

Actual output:

```text
resend._domainkey.multi.deal. 3600 IN TXT "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCt/EYCEZWAAvNc7ZtgcozQ+heKWOfFsoVDR7Q1ABYhQCDpSJGX4ZQEdCh74oHjFg9MI/c/4Y/FXlhc8qU6ELAWqHk4EJJjy0mzvihNx6As0qioJB+o6rGi50gndh/WYB/OHvtfzjLYlIndccrLk6zAQGD4PYPH8WYiC3IO9lazFQIDAQAB"
```

### 3. DMARC — PASS

Command:

```sh
dig TXT _dmarc.multi.deal +noall +answer
```

Actual output:

```text
_dmarc.multi.deal. 300 IN TXT "v=DMARC1; p=none; rua=mailto:rua@dmarc.brevo.com"
```

Record is syntactically valid. Policy is monitoring-only (`p=none`), not enforcement.

### 4. Resend domain verification API — FAIL / owner-only

`RESEND_API_KEY` was absent from process environment and no sourceable local `.dev.vars`-pattern file contained it. `.env.example` files contain placeholders only. No API call was attempted without an owner credential.

Expected command when credential is available:

```sh
RESEND_API_KEY='<REDACTED>' node <owner-supplied-check-script>
```

Required result: `multi.deal` appears with Resend status `verified`; never print the key.

### 5. From/domain consistency — PASS (static)

Commands:

```sh
sed -n '118,130p' apps/web/src/pages/api/auth/magic-link/send.ts
sed -n '235,260p' apps/web/src/server/email/send.ts
sed -n '1,220p' apps/web/src/pages/api/auth/login-email.ts
```

Actual relevant output:

```text
const resendEnv = {
  RESEND_API_KEY: env.RESEND_API_KEY,
  RESEND_FROM_EMAIL: env.RESEND_FROM_EMAIL ?? '',
};
await sendMagicLink(resendEnv, { to: email, locale, magicLinkUrl, expiryIso });

return sendEmail(env, {
  to,
  subject: getSubject(locale, 'magicLink'),
  react: React.createElement(MagicLink, { ...props, locale }),
});

POST /api/auth/login-email
Email + password login.
```

The magic-link path passes configured `RESEND_FROM_EMAIL` into the shared Resend sender. `login-email` performs password/session authentication and sends no email. No wrong hard-coded from-domain was found. Runtime production value remains owner-credential evidence.

### 6. Firebase authorized domains — PASS

Initial command/API output:

```text
GET https://identitytoolkit.googleapis.com/admin/v2/projects/multideal-49eff/config
HTTP 200
{
  "authorizedDomains": [
    "localhost",
    "multideal-49eff.firebaseapp.com",
    "multideal-49eff.web.app",
    "dev.multi.deal"
  ]
}
```

Agent-fixable action: PATCHed only `authorizedDomains`, preserving all existing values and adding `app.multideal.co.il`.

Actual PATCH output:

```text
PATCH https://identitytoolkit.googleapis.com/admin/v2/projects/multideal-49eff/config?updateMask=authorizedDomains
HTTP 200
{
  "authorizedDomains": [
    "localhost",
    "multideal-49eff.firebaseapp.com",
    "multideal-49eff.web.app",
    "dev.multi.deal",
    "app.multideal.co.il"
  ]
}
```

Post-change GET returned HTTP 200 with `app.multideal.co.il` present.

## Appendix A — owner observations

- Resend owner: source `RESEND_API_KEY` into a local process, call Resend `GET /domains`, and record only redacted status confirming `multi.deal` is `verified`.
- Inbox owner: submit one magic-link request for a designated real inbox, open received message, and record arrival plus `Authentication-Results` showing SPF, DKIM, and DMARC pass; redact recipient and token.

## Change record

- Agent changed Firebase Identity Platform authorized domains only; no repository auth configuration file required correction.
- Resend API verification and real-inbox observation remain owner-only because required credential/inbox is unavailable.