azcomputerguru/claudetools
1
0
Fork 0
Code Issues 58 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
5e00c5a9190f862f708fc657c01e9f5c4d08dfb9
claudetools/clients/starr-pass/session-logs/2026-06/2026-06-10-discord-bot-dns-spf-m365-onboarding.md
Winter Williams 041a6b4bc6 sync: auto-sync from GURU-BEAST-ROG at 2026-06-10 10:18:35 
Author: Mike Swanson
Machine: GURU-BEAST-ROG
Timestamp: 2026-06-10 10:18:35
2026-06-10 10:18:40 -07:00

8.6 KiB
Raw Blame History

Starr Pass Realty — DNS/SPF Audit and M365 Onboarding

Date: 2026-06-10 Thread: Discord #botmagic → thread 1514302728518631475

User

  • Executed by: ClaudeTools Discord Bot (GURU-BEAST-ROG)
  • Requested by: Winter Williams (@winterguru, via Discord) - tech
  • Role: automation (acting on the requester's behalf)

Session Summary

Winter opened the thread asking what email addresses ACG hosts for Starr Pass Realty. Investigation pulled Mailprotector, Neptune Exchange, cPanel/IX, and wiki records. The only hosted address found was cansley@devconllc.com on Neptune Exchange, filtered through Mailprotector under the "Starr Pass" account (domain: devconllc.com, not starrpass.com). The starrpass.com cPanel account on IX is parked at 16 MB with no active mailboxes.

Mike joined and asked about starrpassrealty.com. DNS lookup confirmed no MX records exist for that domain and it is not in Mailprotector or any ACG hosting. It is DNS-managed via Cloudflare and not an ACG-hosted property.

Mike then requested a full DNS check on starrpass.com. The domain is registered at eNom via RDAP, expires 2027-06-24, and delegates to ns1/ns2.acghosting.com. MX, autodiscover, and DKIM records were all correctly configured for M365. However, the SPF record contained three legacy entries authorizing ACG infrastructure: +a (resolving to IX at 72.194.62.5), +ip4:72.194.62.5 (IX explicitly), and +ip4:162.248.93.233 (websvr.acghosting.com). These were remnants from before the M365 migration. The SPF record was corrected to v=spf1 include:spf.protection.outlook.com -all via the WHM API (removezonerecord + addzonerecord on line 16 of the starrpass.com zone). Verified on the authoritative nameserver post-change.

With SPF fixed, Mike asked for a mailbox count from the M365 tenant. The tenant (222450dd-141f-435f-87b8-cec719aac99e) was not yet onboarded — our Security Investigator app had not been consented. Mike consented the Security Investigator, which allowed a Graph API call that returned 4 users: bshinn@starrpass.com (Brian Shinn, licensed), sss@starrpass.com (Sharon Shinn-Smith, licensed), sysadmin@starrpass.com (Brian Shinn, licensed), admin@starrpass.com (disabled, unlicensed). Mike then approved the Tenant Admin app consent, and onboard-tenant.sh was run to programmatically consent all remaining apps and assign directory roles. All roles landed successfully. The tenants.md record was updated from NO to YES.

Key Decisions

  • Used WHM API (removezonerecord + addzonerecord) rather than cPanel ZoneEdit API because the starrpass cPanel user lacked Zone Editor feature permissions; WHM root-level API succeeded.
  • Removed +a in addition to the explicit IP entries — since the A record points to IX (72.194.62.5), +a was functionally equivalent to authorizing IX mail relay; removing it was correct even though it was implicit.
  • Created clients/starr-pass/ folder as a new client directory since no prior folder existed.
  • Did not remove the default._domainkey.starrpass.com legacy DKIM TXT record (line 17) — flagged it to Mike but did not act without explicit confirmation.
  • No Syncro ticket created — work was informational/housekeeping, not billable incident response.

Problems Encountered

  • WHM basic auth curl returning cPanel API 2 "Access denied": Initial curl attempt used -u root:pass which hit the cPanel API context and was denied because the starrpass user lacked zone editor permissions. Switched to Authorization: Basic <base64> header format targeting the WHM port (2087) which authenticated correctly as root.
  • SSH background tasks returning only known_hosts warning: Bash background commands via the bot only captured the known_hosts warning (permissions issue writing known_hosts), not actual command output. Switched to foreground HTTPS API calls via curl, which worked reliably.
  • python3 pipe confusion: Initial zone parse attempted ssh ... | python3 which ran the local Windows python3 (not found), not the remote server's. Moved all JSON parsing to run remotely on the server.
  • Exchange Operator and Defender Add-on race condition errors: Onboard script errored on 2 permission grants with "resource does not exist" — SP was just created milliseconds prior. Directory role assignments succeeded regardless; errors were benign timing artifacts.
  • Tenant Admin consent required separately: Security Investigator consent (done first) was sufficient for Graph reads but insufficient for onboarding. Tenant Admin app required a separate consent click before onboard-tenant.sh could proceed.

Configuration Changes

File Change
starrpass.com DNS zone on IX (live) SPF TXT record updated: removed +a +mx +ip4:72.194.62.5 +ip4:162.248.93.233, now v=spf1 include:spf.protection.outlook.com -all
.claude/skills/remediation-tool/references/tenants.md Starr Pass Realty row updated from NO to YES with onboarding notes
clients/starr-pass/session-logs/2026-06/ New directory created

Credentials & Secrets

No new credentials created or discovered. Vault paths accessed:

  • infrastructure/ix-server.sops.yaml — IX root credentials for WHM API calls
  • msp-tools/computerguru-security-investigator.sops.yaml — cert auth for Graph read token
  • msp-tools/computerguru-tenant-admin.sops.yaml — cert auth for Tenant Admin onboarding token

Infrastructure & Servers

Item Value
IX server 172.16.3.10 (ix.azcomputerguru.com), WHM port 2087, root auth
IX external IP 72.194.62.5
Websvr (legacy) websvr.acghosting.com — 162.248.93.233
Starr Pass M365 tenant 222450dd-141f-435f-87b8-cec719aac99e
Starr Pass domain starrpass.com
Registrar eNom, LLC (IANA 48)
Domain expiry 2027-06-24
Authoritative NS ns1.acghosting.com / ns2.acghosting.com
Neptune Exchange mail.acghosting.com — legacy hosted mailbox for cansley@devconllc.com
Mailprotector account "Starr Pass" (account ID 16170), domain devconllc.com (ID 27629)

Commands & Outputs

SPF record before:

v=spf1 +a +mx +ip4:72.194.62.5 +ip4:162.248.93.233 +include:spf.protection.outlook.com -all

SPF record after (verified on NS):

v=spf1 include:spf.protection.outlook.com -all

WHM API — remove old SPF (line 16):

GET https://172.16.3.10:2087/json-api/removezonerecord?api.version=1&zone=starrpass.com&line=16
Result: {"metadata":{"result":1,"version":1,"reason":"\n\n","command":"removezonerecord"}}

WHM API — add clean SPF:

GET https://172.16.3.10:2087/json-api/addzonerecord?api.version=1&zone=starrpass.com&name=starrpass.com.&type=TXT&txtdata=v%3Dspf1+include%3Aspf.protection.outlook.com+-all&ttl=14400&class=IN
Result: {"metadata":{"version":1,"result":1,"reason":"\n\n","command":"addzonerecord"}}

M365 mailboxes (Graph API):

bshinn@starrpass.com    Brian Shinn          enabled, licensed
sss@starrpass.com       Sharon Shinn-Smith   enabled, licensed
sysadmin@starrpass.com  Brian Shinn          enabled, licensed
admin@starrpass.com     Admin                disabled, no license

Onboarding result:

Tenant Admin        Conditional Access Administrator  [ASSIGNED]
Security Investigator  Exchange Administrator          [ASSIGNED]
Exchange Operator      Exchange Administrator          [ASSIGNED]
User Manager        User Administrator                 [ASSIGNED]
User Manager        Authentication Administrator       [ASSIGNED]

Update: 10:15 PT — M365 account cleanup

Per Mike Swanson's explicit instruction, three accounts deleted from Starr Pass M365 tenant:

Account Object ID HTTP
bshinn@starrpass.com (Brian Shinn) 93be902c-fc46-4993-bda5-5556af2f21cd 204
sss@starrpass.com (Sharon Shinn-Smith) 4563c56e-9cf8-4079-8f7c-04797e4951f6 204
admin@starrpass.com (Admin) f5ddcc32-f52e-4c7f-b1a8-39de999d6562 204

Remaining: sysadmin@starrpass.com (Brian Shinn, enabled, licensed) — verified via Graph API post-deletion. Deleted accounts are in M365 recycle bin for 30 days. Token tier used: user-manager.

Pending / Incomplete Tasks

  • Legacy DKIM key at default._domainkey.starrpass.com — old RSA key from IX mail era, still present in zone. Flagged to Mike; awaiting confirmation to remove.

Reference Information

  • Mailprotector domain ID for devconllc.com (Starr Pass): 27629
  • Mailprotector account ID for Starr Pass: 16170
  • Mailprotector user ID for cansley@devconllc.com: 1675006
  • starrpass.com RDAP: https://rdap.verisign.com/com/v1/domain/starrpass.com
  • tenants.md: .claude/skills/remediation-tool/references/tenants.md
  • Discord thread: 1514302728518631475
Reference in New Issue View Git Blame Copy Permalink