Lock down pauseai.org email (null MX, SPF, DMARC)  #1224

(Claude suggestion. Yeah, we should do this. At the moment someone could spoof email as coming from e.g. maxime@pauseai.org)

Concepts

Three DNS records govern email for a domain:

• MX says which servers accept mail for the domain. A "null MX" (0 ., defined in RFC 7505) explicitly says "this domain accepts no mail".
• SPF (a TXT record) lists which servers may send mail as the domain. v=spf1 -all means "none may".
• DMARC (a TXT record at _dmarc) tells receivers what to do with mail that claims to be from the domain but fails SPF/DKIM checks. p=reject means "drop it".

For a domain that never sends or receives mail, the standard practice is to publish all three as above, declaring that no legitimate mail exists.

Holes being closed

• Spoofing. pauseai.org has no SPF or DMARC records today, so nothing tells receivers to reject forged mail such as From: joep@pauseai.org. That makes phishing in PauseAI's name easier. Gmail and others junk much unauthenticated mail anyway, but not reliably.
• Silent delays. With no MX record, mail sent to @pauseai.org falls back to the domain's A record (Netlify), which doesn't accept mail. Senders retry for days before bouncing. A null MX makes them bounce immediately, with a clear error.

Current state

pauseai.org has no MX, no SPF, and no DMARC record. Its DNS is hosted at Openprovider, so changes go through Joep.

Proposed records

pauseai.org.         MX   0 .
pauseai.org.         TXT  "v=spf1 -all"
_dmarc.pauseai.org.  TXT  "v=DMARC1; p=reject"

Before adding them, check in Google Workspace admin that pauseai.org isn't set up as an alias or secondary domain that anyone sends from. With p=reject in place, any such mail would bounce.

Related decision: www.pauseai.org

www.pauseai.org has no DNS record, so it doesn't resolve. There are two options:

We should leave that for now.

Verify

dig +short MX pauseai.org
dig +short TXT pauseai.org
dig +short TXT _dmarc.pauseai.org