IT

• 1: Domain management
• 2: Tech stack

1 - Domain management

DNS

Managed domains

Balean manages the following domains:

• www.balean.org: Balean production environment
• api.balean.org: Balean production backend environment
• balean-app-*.balean.org and api-test-*.balean.org: Test URLS
• newsletter.balean.org: Domain for sending the newsletter and domain used to send newsletter emails
• balean.org: Email domain

DNS Entries explained

NOTE: It is important to keep DNS entries clean. Unused DNS entries should be removed as soon as possible to avoid abuse.

The following 3rd party organizations use the balean.org email domain to send emails from:

• Google Mail:
  • TXT Records:
    • spf
    • google._domainkey -> dkim
    • _dmarc & _dmarc.balean.org
• Google Workspace Domain ownership:
  • CNAME Records:
    • gv-*.googlehosted.com
    • _domainconnect
  • TXT Records:
    • google-site-verification
• Beehiiv:
  • CNAME Records:
    • sendgrid.net
    • branded-link.beehiiv.com
    • *._domainkey -> *.sendgrid.net
    • em* -> *.sendgrid.net
    • newsletter -> cname.beehiiv.com
  • TXT Records:
    • _beehiiv-authentication-*
• Atlassian Cloud
  • CNAME Records:
    • atlassian-bounces
    • atlassian-*._domainkey -> dkim.atlassian.net
  • TXT Records:
    • atlassian-sending-domain-verification
    • atlassian-domain-verification

Email

Balean uses Google Workspace to send emails for personal use. The newsletter is send by Beehiiv via Sendgrid. Atlassian is sending notification emails through our domain.

DMARC

DMARC is a security mechanism for emails and is used to detect unauthorized or insecure usage of the email domains we own. Especially when using external tools to send emails on your behalf, it is important to set the correct DNS entries to allow the use of an email domain.

DMARC is configured for the balean.org email domain. DMARC reports are being send to dmarc-reports [at] balean.org. All emails to that email address are being forwarded to the DMARC Reporting Gitlab project. This project will generate a web-based report form all DMARC Report emails, which can be found on the Gitlab Pages URL of that project.

The DMARC reporting tool contains both an explanation page as well as a troubleshooting page.

DMARC Policy

DMARC policies explained:

DMARC policy was set to Monitoring (p=none) to start with.

Policy enforcement plan:

Changes:

1. DNS Entries on 14 aug. 2025:
   • _dmarc: v=DMARC1; p=none; rua=mailto:dmarc-reports@balean.org
   • SPF: v=spf1 include:_spf.google.com ~all
2. DNS Entries on 19 sept. 2026:
   • _dmarc: v=DMARC1; p=quarantine; rua=mailto:dmarc-reports+aggregate@balean.org; ruf=mailto:dmarc-reports+failure@balean.org; fo=0:1:d:s; pct=25; adkim=r; aspf=r
   • SPF for balean.org: v=spf1 include:_spf.google.com include:sendgrid.net include:mail.atlassian.net include:spf.beehiiv.com include:_spf.e-boekhouden.nl ~all
   • SPF for sbsc.nl: v=spf1 include:_spf.google.com include:_spf.e-boekhouden.nl ~all

DMARC troubleshooting

When you discover violations in your DMARC reports, then consider turning on verbose DMARC reporting. The rua setting in the DMARC DNS entry enables aggregate reports but with the ruf setting, you can turn on forensic reports which are much more elaborate but also very noisy. So only turn them on temporarily.

Reporting email abuse

If you find that an unknown ip-address is spoofing your domain, report it to the ip-address owner by sending an email to the IP’s abuse contact (e.g., abuse@aws.amazon.com for AWS).

2 - Tech stack

Office applications

Development