# Session Log: 2026-04-21

## User
- **User:** Mike Swanson (mike)
- **Machine:** DESKTOP-0O8A1RL
- **Role:** admin

## Session Summary

Diagnosed and resolved desertrat.com email routing issues reported by Mike Furrier. Also performed significant Syncro API research and corrections as a side effect of ticketing this work.

---

## Client: Furrier (Mike Furrier / Western Tire / Desert Rat)

**Syncro Customer ID:** 391491
**Syncro Ticket:** #32181 (ID: 109263692) — "desertrat.com - Email / Mailprotector SBR Setup & Repair"
**Invoice:** #67437 (ID: 1650004395) — $75.00 labor + tax = $81.53

---

## Problem Report

Mike Furrier reported that tim@desertrat.com was being rejected with:
```
550 5.7.1 tim@desertrat.com is not allowed to send email on behalf of this domain due to a DMARC reject policy.
```
Message was from tim@desertrat.com to desertrat64@desertrat.com.

---

## DNS Analysis (desertrat.com)

**DNS Host:** AWS Route 53

**DMARC:**
```
v=DMARC1; p=reject; sp=reject; adkim=r; aspf=r; pct=100
```
Full enforcement, 100%.

**SPF:**
```
v=spf1 +a +mx +ip4:162.248.93.233 +ip4:162.248.93.81 +include:spf.wdsolutions.com +include:spf.us.emailservice.io -all
```

**MX:**
```
priority 10 → desertrat-com.inbound.emailservice.io
priority 20 → desertrat-com.inbound.emailservice.cc
priority 30 → desertrat-com.inbound.emailservice.co
```
emailservice.io is the Mailprotector spam filter front-end.

**DKIM:**
`default._domainkey.desertrat.com` — key exists, published, signed by Websvr (cPanel default selector).

---

## Infrastructure

**Websvr (cPanel/WHM):**
- Host: websvr.acghosting.com
- External IP: 162.248.93.233 (verified from server — vault listed .81 as secondary)
- SSH: root / r3tr0gradE99# (port 22)
- WHM API Token: 8ZPYVM6R0RGOHII7EFF533MX6EQ17M7O
- OS: CentOS 7, WHM 11.110.0.95
- SSH host key: SHA256:qcaW8BWq5UyM0l0g6DS9JfYbMZN/LTXLs3BIEZV8BE0

**plink command for SSH:**
```bash
plink -ssh -pw "r3tr0gradE99#" -hostkey "SHA256:qcaW8BWq5UyM0l0g6DS9JfYbMZN/LTXLs3BIEZV8BE0" root@websvr.acghosting.com -batch "<command>"
```

**cPanel account:** desertra
**Domain:** desertrat.com

---

## Root Cause Analysis

1. **tim@desertrat.com is a forwarder, not a mailbox** — exists in `/etc/valiases/desertrat.com` forwarding to timfurrier@gmail.com. Mike had checked cPanel accounts (wrong place to look).

2. **Mailprotector SBR was unconfigured** — exim had the `mailprotector_smarthost` router configured to route outbound through `{domain}.outbound.emailservice.io`, but `/etc/mailprotector_domains` was empty. desertrat.com was never enrolled.

3. **Mail flow was broken** — without SBR enrollment, outbound forwarded mail from Websvr went direct (not through emailservice.io). emailservice.io is authorized in SPF; direct Websvr sends are also authorized (Websvr IPs in SPF), so SPF technically passes, but the DMARC issue is Tim replying from Gmail.

4. **Tim's DMARC rejection** — Tim receives forwarded mail at timfurrier@gmail.com and replies using tim@desertrat.com as From. Gmail's servers are not in desertrat.com's SPF → DMARC p=reject → rejected by emailservice.io on inbound.

---

## Fix Applied

Added `desertrat.com` to `/etc/mailprotector_domains` on Websvr:
```bash
echo 'desertrat.com' >> /etc/mailprotector_domains
```

Verified outbound routing in exim log:
```
R=mailprotector_smarthost T=mailprotector_relay
H=desertrat-com.outbound.emailservice.io
C="250 2.0.0 Ok: queued as 69DF27E284"
```

No exim restart required — file is checked at runtime via lsearch lookup.

---

## Mailprotector User Import

Created bulk user import CSV for Mailprotector at:
`C:\Users\guru\Downloads\desertrat_mailprotector_import.csv`

38 entries covering all desertrat.com mailboxes and forwarders from `/etc/valiases/desertrat.com` and `/home/desertra/mail/desertrat.com/`.

Format: `Username,First Name,Last Name,Password,Secondary Email,Phone,Primary Username`

Aliases (Primary Username set):
- desertrat60 → store60
- desertrat60r → store60r
- desertrat62 → store62
- desertrat64 → store64
- desertat64 → store64 (typo address, included as it exists)
- jobs → tim

---

## Outstanding Items

1. **Tim sending via Gmail** — DMARC p=reject will continue to block Tim replying from Gmail as tim@desertrat.com. Fix: Tim configures Gmail "Send mail as" with Websvr SMTP:
   - SMTP Server: mail.desertrat.com
   - Port: 587 (STARTTLS) or 465 (SSL)
   - Username: tim@desertrat.com
   - Password: Tim's cPanel email password (reset via WHM if needed)

2. **WebShop / DKIM** — DKIM already active on Websvr (`default._domainkey.desertrat.com`). No WebShop action needed for DKIM unless they need their own selector for their outbound.

3. **Mailprotector user sync** — CSV delivered to Mike for manual import into Mailprotector admin. No automated sync available (emailservice.io only offers AD/365/Google as sync sources).

4. **WebShop "extra code"** — Likely a DKIM record they wanted added to Route 53. Since Websvr's DKIM is already in DNS and active, this may be moot. Confirm with WebShop.

---

## Syncro Ticket Details

- **Ticket #32181** — created, comment posted, 30 min remote labor billed
- **Invoice #67437** — $75.00 + tax = $81.53, status: Invoiced
- Ticket status: Invoiced

---

## Syncro API Corrections (side work this session)

Significant research was done to fix incorrect skill documentation. All findings validated against official swagger spec at `https://api-docs.syncromsp.com/swagger.json` and live-tested on ACG client (ID: 15353550).

### Correct billing flow
**Wrong (old):** `POST /tickets/{id}/timer_entry` — timer entries do NOT become invoice line items.

**Correct:** `POST /tickets/{id}/add_line_item` with:
- `name` (required)
- `description` (required)
- `product_id`
- `quantity` (decimal hours)
- `price_retail` — ONLY price field that saves; all other names (`price`, `rate`, `retail_price`) silently ignored

### Correct line item removal
**Wrong (old):** `DELETE /tickets/{id}/line_items/{id}` — returns 404, does nothing.

**Correct:** `POST /tickets/{id}/remove_line_item` with `{"ticket_line_item_id": N}` — returns `{"success": true}`

### Timer operations (correct endpoints)
- Delete timer: `POST /tickets/{id}/delete_timer_entry` with `{"timer_entry_id": N}`
- Charge timer → line item: `POST /tickets/{id}/charge_timer_entry` with `{"timer_entry_id": N}`

### Comment DELETE
**Not possible via API.** No DELETE endpoint for comments exists in the Syncro swagger spec. Duplicate comments require manual GUI removal (ask Winter).

### Duplicate comment prevention
Server has no idempotency. Never retry `POST /comment` without first `GET /tickets/{id}` to verify the comment didn't already land.

### Invoice line item DELETE
`DELETE /invoices/{id}/line_items/{line_item_id}` — **works** (returns HTTP 200).

### Skill doc updated
`.claude/commands/syncro.md` — fully rewritten billing section with correct endpoints.

---

## Files Modified

- `/etc/mailprotector_domains` on websvr.acghosting.com — added desertrat.com
- `C:\Users\guru\Downloads\desertrat_mailprotector_import.csv` — created
- `D:\claudetools\.claude\commands\syncro.md` — Syncro skill doc corrected
- `D:\claudetools\clients\furrier\session-logs\2026-04-21-session.md` — this file
