Domain management

Everything about domains, DNS and external tools using our domains

DNS

Managed domains

Balean manages the following domains:

  • www.balean.org: Balean production environment
  • api.balean.org: Balean production backend environment
  • balean-app-*.balean.org and api-test-*.balean.org: Test URLS
  • newsletter.balean.org: Domain for sending the newsletter and domain used to send newsletter emails
  • balean.org: Email domain

DNS Entries explained

NOTE: It is important to keep DNS entries clean. Unused DNS entries should be removed as soon as possible to avoid abuse.

The following 3rd party organizations use the balean.org email domain to send emails from:

  • Google Mail:
    • TXT Records:
      • spf
      • google._domainkey -> dkim
      • _dmarc & _dmarc.balean.org
  • Google Workspace Domain ownership:
    • CNAME Records:
      • gv-*.googlehosted.com
      • _domainconnect
    • TXT Records:
      • google-site-verification
  • Beehiiv:
    • CNAME Records:
      • sendgrid.net
      • branded-link.beehiiv.com
      • *._domainkey -> *.sendgrid.net
      • em* -> *.sendgrid.net
      • newsletter -> cname.beehiiv.com
    • TXT Records:
      • _beehiiv-authentication-*
  • Atlassian Cloud
    • CNAME Records:
      • atlassian-bounces
      • atlassian-*._domainkey -> dkim.atlassian.net
    • TXT Records:
      • atlassian-sending-domain-verification
      • atlassian-domain-verification

Email

Balean uses Google Workspace to send emails for personal use. The newsletter is send by Beehiiv via Sendgrid. Atlassian is sending notification emails through our domain.

DMARC

DMARC is a security mechanism for emails and is used to detect unauthorized or insecure usage of the email domains we own. Especially when using external tools to send emails on your behalf, it is important to set the correct DNS entries to allow the use of an email domain.

DMARC is configured for the balean.org email domain. DMARC reports are being send to dmarc-reports [at] balean.org. All emails to that email address are being forwarded to the DMARC Reporting Gitlab project. This project will generate a web-based report form all DMARC Report emails, which can be found on the Gitlab Pages URL of that project.

The DMARC reporting tool contains both an explanation page as well as a troubleshooting page.

DMARC Policy

DMARC policies explained:

Policy Setting Impact Use Case
p none Monitor only: No enforcement. All emails are delivered, but reports are sent. Start here to analyze senders before enforcing.
p quarantine Send to spam/junk: Emails failing DMARC are quarantined (not delivered to inbox). Test enforcement without blocking emails.
p reject Block entirely: Emails failing DMARC are rejected at the SMTP level (bounced). Full enforcement for domains with confirmed legitimate senders.
pct 1-100 Percentage of emails to apply the policy to (e.g., pct=50 applies p= to 50% of emails). Gradually roll out enforcement (e.g., start with pct=10).
rua Email address Aggregate reports: Where to send XML reports (e.g., rua=mailto:reports@balean.org). Required to receive DMARC reports.
ruf Email address Forensic reports: Where to send failure details (e.g., ruf=mailto:forensic@balean.org). Optional; provides details on individual failures (may include sensitive data).
adkim r (relaxed) DKIM alignment: Domain in DKIM signature can be a subdomain of the From: domain. Default; easier to implement.
adkim s (strict) DKIM alignment: Domain in DKIM signature must match the From: domain exactly. Stricter security; use if you control all subdomains.
aspf r (relaxed) SPF alignment: SPF domain can be a subdomain of the From: domain. Default; easier to implement.
aspf s (strict) SPF alignment: SPF domain must match the From: domain exactly. Stricter security; use if you control all subdomains.

DMARC policy was set to Monitoring (p=none) to start with.

Policy enforcement plan:

Action Planned date Actial date Outcome
DMARC configured (p=none) 14 August 2025 14 August 2025 A few failed reports in August but limited.
Move to p=quarantine 4 sept 2026 19 sept 2026
Move to p=reject 4 okt 2026

Changes:

  1. DNS Entries on 14 aug. 2025:
    • _dmarc: v=DMARC1; p=none; rua=mailto:dmarc-reports@balean.org
    • SPF: v=spf1 include:_spf.google.com ~all
  2. DNS Entries on 19 sept. 2026:
    • _dmarc: v=DMARC1; p=quarantine; rua=mailto:dmarc-reports+aggregate@balean.org; ruf=mailto:dmarc-reports+failure@balean.org; fo=0:1:d:s; pct=25; adkim=r; aspf=r
    • SPF for balean.org: v=spf1 include:_spf.google.com include:sendgrid.net include:mail.atlassian.net include:spf.beehiiv.com include:_spf.e-boekhouden.nl ~all
    • SPF for sbsc.nl: v=spf1 include:_spf.google.com include:_spf.e-boekhouden.nl ~all

DMARC troubleshooting

When you discover violations in your DMARC reports, then consider turning on verbose DMARC reporting. The rua setting in the DMARC DNS entry enables aggregate reports but with the ruf setting, you can turn on forensic reports which are much more elaborate but also very noisy. So only turn them on temporarily.

Reporting email abuse

If you find that an unknown ip-address is spoofing your domain, report it to the ip-address owner by sending an email to the IP’s abuse contact (e.g., abuse@aws.amazon.com for AWS).


Last modified September 19, 2026: Add new dmarc config (7c831a7)