Add SPF to SES service

[mogul]

User Story

In order to ensure mail sent via provisioned SES services is accepted by receivers, the SSB team wants brokered SES services to include Sender Policy Framework (SPF) records for AWS.

Acceptance Criteria

[ACs should be clearly demoable/verifiable whenever possible. Try specifying them using BDD.]

• GIVEN I have have provisioned an SES service instance
  AND I did NOT provide a domain configuration during provisioning
  WHEN I check the DNS for the associated domain
  THEN I find a valid SPF record for AWS
• GIVEN I have have provisioned an SES service instance
  AND I DID provide a domain configuration during provisioning
  WHEN I check the credentials for a service binding
  THEN I see content for a SPF record for AWS
  AND the instructions tell me to create that record in my DNS system

Background

[Any helpful contextual notes or links to artifacts/evidence, if needed]
SPF: https://dmarcian.com/what-is-spf/
Truss' example: https://github.com/trussworks/terraform-aws-ses-domain/blob/2df07ab2452d65f13701e984cb3ad0caeb315aee/main.tf#L66-L85

Security Considerations (required)

This change will prevent bad actors from sending mail on behalf of one of our SES services without going through AWS and having it blindly accepted by SPF-conversant hosts. It will also ensure deliverability of legitimate mail.

Sketch

• Add the SPF record output to the provisioning spec
• Output the SPF record when a domain is supplied (in outputs.tf)
• Generate the record in Route53 when no domain is supplied (in verification.tf)

[mogul]

We need some kind of test to ensure we have SPF set up correctly. Here are some options:

• https://github.com/serain/mailspoof
• https://email-test.had.dnsops.gov/
• https://dmarcmonitor.net/dmarc-spf-dkim-validator/
• https://www.dmarcanalyzer.com/spf/checker/

[nickumia-reisys]

Can we create a fake SMTP server and test sending mail internally? https://www.tothenew.com/blog/setting-up-sendmail-inside-your-docker-container/

[nickumia-reisys]

All of the automated tests pretty much just check if there is a record that looks like SPF and returns true if that's met, so I implemented a version of that.