{"id":"69eabcded114cbdda8237d3c","title":"2026 04 24","path":"how-to/committee/release-notes/2026-04-24","contentMarkdown":"# 24-Apr-2026 — SPF/DMARC management, plain-text alternatives, List-Unsubscribe header\n\n## GitHub [#186](https://github.com/nbarrett/ngx-ramblers/issues/186) — [commit 77db1d9](https://github.com/nbarrett/ngx-ramblers/commit/77db1d9fbe0b9c925c198ddca31ef6ec82806c46)\n\n_____\n\nThree deliverability fixes for transactional email, headlined by a new **Email Authentication** panel on the Brevo Senders page that lets admins fix SPF and DMARC with one click.\n\n## Email Authentication panel\n\nThe new panel sits above the existing MX records panel and shows colour-coded badges for SPF and DMARC, the current record contents, and a **Fix Auth Records** button that merges missing includes or creates the records. Existing policies are never widened; multi-record SPF states disable the button with a tooltip pointing at manual consolidation.\n\n### SPF missing the Brevo include\n\n![](https://ngx-ramblers.org.uk/api/aws/s3/site-content/2c0fb82e-b576-4806-bf9e-247fcb7550d1.png)\n\n*ashfordramblers.org.uk — SPF exists for the Cloudflare mail path but misses `spf.brevo.com`. DMARC is already in place and is left untouched.*\n\n### Stricter existing DMARC\n\n![](https://ngx-ramblers.org.uk/api/aws/s3/site-content/ea2b9a7b-7fcf-478e-99b6-2f9d627abc2c.png)\n\n*canterburyramblers.org.uk — same SPF gap, but this domain runs `p=reject`. The fix will merge in the Brevo include while preserving the stricter policy exactly.*\n\n### SPF fixed — strict DMARC preserved\n\n![](https://ngx-ramblers.org.uk/api/aws/s3/site-content/f059120c-d169-4145-a5f4-5efd1eb047fd.png)\n\n*canterburyramblers.org.uk after **Fix Auth Records** — SPF now contains both `_spf.mx.cloudflare.net` and `spf.brevo.com`; `p=reject` is retained.*\n\n### Fresh domain with nothing in place\n\n![](https://ngx-ramblers.org.uk/api/aws/s3/site-content/fb4dffc5-7c30-4d52-b93d-388b59b2524a.png)\n\n*berkshire-weekend-walkers.ngx-ramblers.org.uk — nothing at all. The panel shows exactly what will be created before the button is pressed.*\n\n### After one-click fix on a fresh domain\n\n![](https://ngx-ramblers.org.uk/api/aws/s3/site-content/817a914f-12ec-47a7-a450-702195e80677.png)\n\n*Fresh `v=spf1 include:_spf.mx.cloudflare.net include:spf.brevo.com ~all` created, plus a monitor-only `v=DMARC1; p=none` so the admin can raise enforcement later without surprise.*\n\n## Other fixes shipping with this change\n\n- **Plain-text alternative** — every transactional email now gets a `textContent` derived from HTML when the caller supplied none. HTML-only mail is a documented spam-filter penalty signal.\n- **List-Unsubscribe header** — `` is added to transactional sends unless the caller sets its own. Campaigns are unchanged; Brevo manages their unsubscribe headers natively.\n- **Migration iterates every Brevo-registered domain**, not just the env's configured `baseDomain`. Per-domain failures are logged and skipped — one bad zone can't block the rest.\n- **www-vs-apex false warning fixed** — a new shared `apexHost()` helper strips `www.` on both sides of the site/Brevo-domain comparison.\n- **Cleaner 500 responses** — a shared `errorResponse(error)` returns `{code, message}` so clients see the real cause instead of a serialised empty Error.\n- **Idempotent destination-address creation** — POSTing an existing address returns the match instead of tripping Cloudflare's \"verification sent too recently\" cooldown.","contentHtml":"

24-Apr-2026 — SPF/DMARC management, plain-text alternatives, List-Unsubscribe header

\n

GitHub #186 — commit 77db1d9

\n
\n

Three deliverability fixes for transactional email, headlined by a new Email Authentication panel on the Brevo Senders page that lets admins fix SPF and DMARC with one click.

\n

Email Authentication panel

\n

The new panel sits above the existing MX records panel and shows colour-coded badges for SPF and DMARC, the current record contents, and a Fix Auth Records button that merges missing includes or creates the records. Existing policies are never widened; multi-record SPF states disable the button with a tooltip pointing at manual consolidation.

\n

SPF missing the Brevo include

\n

\"\"

\n

ashfordramblers.org.uk — SPF exists for the Cloudflare mail path but misses spf.brevo.com. DMARC is already in place and is left untouched.

\n

Stricter existing DMARC

\n

\"\"

\n

canterburyramblers.org.uk — same SPF gap, but this domain runs p=reject. The fix will merge in the Brevo include while preserving the stricter policy exactly.

\n

SPF fixed — strict DMARC preserved

\n

\"\"

\n

canterburyramblers.org.uk after Fix Auth Records — SPF now contains both _spf.mx.cloudflare.net and spf.brevo.com; p=reject is retained.

\n

Fresh domain with nothing in place

\n

\"\"

\n

berkshire-weekend-walkers.ngx-ramblers.org.uk — nothing at all. The panel shows exactly what will be created before the button is pressed.

\n

After one-click fix on a fresh domain

\n

\"\"

\n

Fresh v=spf1 include:_spf.mx.cloudflare.net include:spf.brevo.com ~all created, plus a monitor-only v=DMARC1; p=none so the admin can raise enforcement later without surprise.

\n

Other fixes shipping with this change

\n\n"}