Email Routing — raxx.app mailboxes

Purpose: Authoritative map of every @raxx.app email address: what it is, how it routes, and who watches it. DNS authority: Cloudflare (raxx.app zone). Last updated: 2026-05-11 UTC Related issue: #1212

Architecture decision

Per docs/business/business-email.md and project_email_mental_model.md:

• Human-to-human email: Google Workspace (primary domain moosequest.net, alias domain raxx.app). Addresses on raxx.app that receive human replies route to Kristerpher's Google Workspace inbox.
• Serviceable / SLA-bearing inbound: FreeScout at tickets.raxx.app via Postmark SMTP relay. support@raxx.app is the sole customer-facing inbound address routed through this path.
• Automated outbound: Postmark API (Raptor → SNS → SQS → Lambda → Postmark in v1 hybrid; see docs/architecture/durable-email-delivery.md).

Mailbox map

Provisioning state (as of 2026-05-11 UTC)

Provisioning instructions (operator — Google Admin)

Google Workspace Admin actions cannot be scripted from outside the tenant. The steps below are copy-pasteable for the next operator session.

ops@raxx.app — Google Group

1. Open https://admin.google.com → Directory → Groups → Create group.
2. Name: Raxx Ops.
3. Group email: ops@raxx.app.
4. Access type: Restricted (only org members can post; external senders via "Allow messages from outside the organization" setting — enable this, otherwise CloudWatch SNS notifications are rejected).
5. Add kris@moosequest.net as owner.
6. Save.
7. In group settings → Email options → set "Who can post" to include external senders (required for CloudWatch alarm notifications).
8. Test: send a message to ops@raxx.app from an external address (e.g., personal Gmail). Confirm it arrives in kris@moosequest.net inbox within 2 minutes.

billing@raxx.app — Google Group

1. Open https://admin.google.com → Directory → Groups → Create group.
2. Name: Raxx Billing.
3. Group email: billing@raxx.app.
4. Access type: Restricted. Enable external senders (Stripe and other billing systems send from external domains).
5. Add kris@moosequest.net as owner and sole initial member.
6. Save.
7. Test: send a message to billing@raxx.app from an external address. Confirm delivery to kris@moosequest.net.

Critical: Do not leave billing@raxx.app unwatched before Stripe or any billing system is configured to send to it. A blind billing inbox creates a silent failure path for invoices and fraud alerts.

no-reply@raxx.app — design decision required

Two options. Operator must choose one before provisioning.

Option A — User alias (recommended for v1): - Add no-reply@raxx.app as a send-as alias for kris@moosequest.net in Google Admin. - Inbound to this address: delivered to Kristerpher's inbox (some bounce replies and OOO auto-replies will arrive here; low volume at v1, acceptable). - Cost: zero (no additional license consumed). - Limitation: reply-to bounce handling is not automated.

Option B — Dedicated Workspace user: - Create a new Workspace user no-reply@raxx.app with mailbox. - Set a vacation auto-reply: "This address does not accept replies. For help, contact support@raxx.app." - Consumes one license (~$6–18/mo depending on plan tier). - Bounce replies land in a real monitored mailbox.

Recommendation (v1): Option A. The address is outbound-only by design; the occasional bounce reply arriving in Kristerpher's inbox is acceptable signal at pre-launch volume. Revisit Option B when customer volume justifies the license cost.

Implementation (Option A): 1. Google Admin → Users → Kristerpher → Aliases → Add alias. 2. Add no-reply@raxx.app as an alias. 3. In Gmail → Settings → Accounts and Import → Add another email address. 4. Enter no-reply@raxx.app. Google auto-verifies (alias of verified user). 5. This address is now available as a "Send mail as" option in Gmail — Postmark also uses it via the Sender Signature configuration.

Postmark sender signatures

Postmark sends on behalf of raxx.app using these verified signatures. DNS records are on Cloudflare.

As new addresses are added to Postmark (e.g., no-reply@raxx.app as a separate sender), update the table above and add the corresponding DKIM selector to Cloudflare DNS.

At v1, a single Postmark sender signature covering the raxx.app domain (not per-address) is sufficient. Postmark's domain-level signing means any @raxx.app from-address passes DKIM alignment.

SPF / DKIM / DMARC — raxx.app (current, verified)

No changes required on raxx.app DNS for this card.

FreeScout mailbox IDs (for SNS/SQS routing map)

Per docs/architecture/durable-email-delivery.md Section 4, the inbound Lambda routing map in SSM (/raxx/email/mailbox_routing_map) references FreeScout numeric mailbox IDs. IDs must be confirmed after FreeScout mailbox creation.

To retrieve IDs after FreeScout mailbox provisioning:

FS_KEY=$(infisical secrets get FREESCOUT_API_KEY --path /MooseQuest/freescout --env prod --plain)
curl -s \
  -H "Authorization: Bearer $FS_KEY" \
  https://tickets.raxx.app/api/mailboxes \
  | python3 -m json.tool

Update the table above and the SSM parameter at /raxx/email/mailbox_routing_map when IDs are confirmed.

Related

• Issue: #1212 (this card)
• docs/ops/email-dns-state.md — moosequest.net SPF/DKIM/DMARC state
• docs/business/business-email.md — Google Workspace multi-domain architecture
• docs/architecture/durable-email-delivery.md — email pipeline design (SNS/SQS/Lambda/Postmark)
• docs/ops/runbooks/freescout-postmark-relay.md — FreeScout outbound SMTP via Postmark
• docs/ops/runbooks/freescout-operations-mailbox-provisioning.md — ops mailbox setup in FreeScout