terraform-cloudflare-email

Terraform module to configure various email related DNS records on Cloudflare.

Module that configures various email related DNS records on Cloudflare, including serving a MTA-STS policy text file via Cloudflare Workers.

Features

• Configure MX records.
• Configure SPF record.
• Configure DMARC record.
• Configure SMTP TLS reporting record.
• Configure MTA-STS record, generate mta-sts.txt policy file and serve it with a Cloudflare Worker on https://mta-sts.<your-domain>/.well-known/mta-sts.txt.
• Configure domain key records (<selector>._domainkey.<your-domain>).

Requirements

Name	Version
cloudflare	>= 3.0, < 5.0

Providers

Name	Version
cloudflare	>= 3.0, < 5.0

Modules

No modules.

Resources

Name	Type
cloudflare_record.dmarc	resource
cloudflare_record.domainkeys	resource
cloudflare_record.mta-sts-a	resource
cloudflare_record.mta-sts-aaaa	resource
cloudflare_record.mta_sts	resource
cloudflare_record.mx	resource
cloudflare_record.smtp_tls	resource
cloudflare_record.spf	resource
cloudflare_worker_route.mta_sts_route	resource
cloudflare_worker_script.mta_sts	resource
cloudflare_workers_kv.mta_sts	resource
cloudflare_workers_kv_namespace.mta_sts	resource
cloudflare_zone.zone	data source

Inputs

Name	Description	Type	Default	Required
account_id	Cloudflare Account ID	string	n/a	yes
dmarc_dkim_mode	The DMARC DKIM mode for alignment (options: relaxed, strict).	string	"relaxed"	no
dmarc_fo	Failure reporting options for DMARC (characters: 0, 1, d, s, separated by :).	string	"1:d:s"	no
dmarc_percent	Percentage of messages to apply the DMARC policy to (0-100).	number	100	no
dmarc_policy	The DMARC policy to apply (options: none, quarantine, reject).	string	"none"	no
dmarc_rua	Where aggregate DMARC reports about policy violations should be sent.	list(string)	n/a	yes
dmarc_ruf	Where failure/forensic DMARC reports about policy violations should be sent.	list(string)	[]	no
dmarc_spf_mode	The DMARC SPF mode for alignment (options: relaxed, strict).	string	"relaxed"	no
dmarc_ttl	TTL for _dmarc DNS record. 1 is auto. Default is 1.	number	1	no
domainkeys	Map of domain keys with name, record type (TXT or CNAME), and value.	map(object({ type = string value = string }))	{}	no
mta_sts_max_age	Maximum lifetime of the policy in seconds, up to 31557600, defaults to 604800 (1 week)	number	604800	no
mta_sts_mode	MTA policy mode, https://tools.ietf.org/html/rfc8461#section-5	string	"testing"	no
mta_sts_mx	Additional permitted MX hosts for the MTA STS policy.	list(string)	[]	no
mx	A map representing the MX records. Key is the priority and value is the mail server hostname.	map(number)	n/a	yes
mx_subdomains	List of sub-domains to also apply MX records to.	list(string)	[]	no
record_ttl	TTL for DNS records. 1 is auto. Default is 1.	number	1	no
spf_terms	List of SPF terms that should be included in the SPF TXT record.	list(string)	[ "mx", "a", "~all" ]	no
tlsrpt_rua	Locations to which aggregate TLS SMTP reports about policy violations should be sent, either mailto: or https: schema.	list(string)	n/a	yes
zone_id	Cloudflare Zone ID	string	n/a	yes

Outputs

Name	Description
mta_sts_policy_url	URL to the MTA-STS policy file.