Add DMARC to SES service

[mogul]

User Story

In order to improve handling and reporting of email delivery failures, the data.gov team wants brokered SES services to include DMARC records.

Acceptance Criteria

[ACs should be clearly demoable/verifiable whenever possible. Try specifying them using BDD.]

• GIVEN I have have provisioned an SES service instance
  AND I did NOT provide a domain configuration during provisioning
  AND I provided a reporting address during provisioning
  WHEN I check the DNS for the associated domain
  THEN I find a valid DMARC record
  AND the DMARC record contains the reporting address
• GIVEN I have have provisioned an SES service instance
  AND I DID provide a domain configuration during provisioning
  AND I provided a reporting address during provisioning
  WHEN I check the credentials for a service binding
  THEN I see content for a DMARC record
  AND the DMARC record contains the reporting address
  AND the instructions tell me to create that record in my DNS system

Background

[Any helpful contextual notes or links to artifacts/evidence, if needed]
How DMARC works: https://dmarc.org/overview/
Truss' example: https://github.com/trussworks/terraform-aws-ses-domain/blob/2df07ab2452d65f13701e984cb3ad0caeb315aee/main.tf#L110-L119

Security Considerations (required)

None... This builds on earlier work to add DKIM and SPF, which increase security. This change will only improve reporting/feedback.

Sketch

[Notes or a checklist reflecting our understanding of the selected approach]

• Add the reporting address to the input parameters
• Add the DMARC record output to the provisioning spec
• Output the DMARC record when a domain is supplied (in outputs.tf)
• Generate the record in Route53 when no domain is supplied (in verification.tf)

[mogul]

We need some kind of test to ensure we have DMARC set up correctly. Here are some options:

• https://github.com/serain/mailspoof
• https://domainaware.github.io/checkdmarc/
• https://email-test.had.dnsops.gov/
• https://fraudmarc.com/dmarc-check/
• https://mxtoolbox.com/dmarc/dmarc-email-tools
• https://dmarcmonitor.net/dmarc-spf-dkim-validator/
• https://www.dmarcanalyzer.com/dmarc/dmarc-record-check/

[jbrown-xentity]

Looking at testing options, I like setting up https://domainaware.github.io/checkdmarc/ in github actions on a cron, to be able to check for drift (and would cover spf)... Thoughts @mogul? All of these tests only work on a deployed system, none of these would actually check our code before it is deployed...

[nickumia-reisys]

Not sure the best way to combine these two conversations, but related.