Add Storage Box backup target to DocFast state

projects/business/memory/decisions.md

@@ -61,6 +61,35 @@ We don't have custom templates. Listing them is false advertising. Removed from
 ## 2026-02-14 17:37 UTC — BUG-015: Migrate to SQLite
 File-based JSON won't survive concurrent requests. SQLite is the right choice for our scale (single server, <1000 users). No need for PostgreSQL yet. DB file on Docker volume for persistence.
 
+## 2026-02-16 — Email Infrastructure: Scaling Strategy
+
+**Context:** Currently running Postfix on the single app server (docfast-1). Investor asked how this scales behind a load balancer.
+
+**Options evaluated:**
+- **A) Dedicated mail server** — Separate VM running Postfix/Exim. Centralizes DKIM/SPF/PTR config, app servers relay through it. Moderate cost (~€4/mo for CX22), full control.
+- **B) External email service** (Postmark, SES, SendGrid) — Best deliverability, no infra to manage, built-in analytics/bounce handling. ~$15-25/mo at our scale. Postmark recommended (focused on transactional email, excellent deliverability).
+- **C) Keep Postfix on app server with relay** — Each app server relays through a central SMTP. Quick to set up but still managing Postfix everywhere.
+
+**Recommendation: Option B (External service — Postmark)**
+
+Reasons:
+1. **Deliverability** — Services like Postmark have pre-warmed IPs with established reputation. We're fighting spam scores on a fresh Hetzner IP.
+2. **Scaling** — Zero config when adding app servers. Just use the API/SMTP credentials.
+3. **Operational cost** — No PTR/DKIM/SPF debugging. No Postfix maintenance. Engineer time > €15/mo.
+4. **Analytics** — Bounce rates, open tracking, delivery confirmation built-in.
+5. **When to implement** — After launch validation. Current Postfix setup is fine for MVP with the deliverability fixes applied today.
+
+**Migration path:** Keep Postfix for now (with today's SPF/DMARC/PTR fixes). Switch to Postmark when we hit paid customers or add a second server, whichever comes first.
+
+## 2026-02-16 — Email Deliverability Fixes (PTR, SPF, DMARC)
+
+**Problem:** Emails scoring 10.90 spam score. Three issues identified:
+1. PTR record showing generic Hetzner hostname → changed to `mail.docfast.dev`
+2. SPF using `~all` (softfail) → changing to `-all` (hardfail)
+3. DMARC using `p=none` → changing to `p=quarantine`
+
+**Status:** PTR fixed via Hetzner Cloud API. SPF and DMARC require Hetzner DNS API token (not currently in credentials). A record for `mail.docfast.dev` also needed.
+
 ## 2026-02-14 17:37 UTC — Deferred items (with reasoning)
 - BUG-016 (backups): Deferred to next session. Need to research Hetzner object storage or simple cron+scp backup.
 - BUG-017 (benchmarking): Deferred. Need load testing tools, will do before scaling marketing.

projects/business/memory/state.json

@@ -52,7 +52,7 @@
     "sshKey": "/home/openclaw/.ssh/docfast",
     "smtp": "Postfix + OpenDKIM configured. DKIM-signed emails working. SPF/DKIM/DMARC DNS records live.",
     "email": "noreply@docfast.dev",
-    "backups": "BorgBackup daily at 03:00 UTC (local). PostgreSQL + Docker volumes + configs.",
+    "backups": "BorgBackup daily at 03:00 UTC (local). PostgreSQL + Docker volumes + configs. Off-site: ssh -p23 u149513-sub11@u149513-sub11.your-backup.de (SSH key installed at /root/.ssh/id_ed25519)",
     "cicd": "Forgejo Actions workflow (pending secrets setup)",
     "infraDocs": "infrastructure/ directory with full provisioning scripts"
   },