Fix DMARC guidance for send-only relays with optional rua= settings.

The panel now suggests policy-only DMARC by default, lets operators configure a default and per-domain report address, and DNS-checks hub _report._dmarc records. Future in-panel report ingestion is tracked as dmarc-reports in the roadmap.

Co-authored-by: Cursor <cursoragent@cursor.com>

CHANGELOG.md

@@ -7,6 +7,12 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ### Added
 
+- panel: DMARC guidance for send-only relays — the suggested `_dmarc` record
+  is now `p=none` without `rua=` by default; *Settings* and each domain page
+  let you configure an optional aggregate-report address (profile default plus
+  per-domain inherit / none / custom). When `rua=` targets another domain, the
+  panel shows and DNS-checks the hub's `_report._dmarc` authorisation record.
+  Domain export/import carries per-domain overrides.
 - AGPL packaging hygiene: [NOTICE](NOTICE) names the copyright holder and the
   bundled third-party works (htmx 0BSD, IBM Plex OFL in outlined logos); the
   panel footer on every page — including login and setup — shows copyright, a
@@ -27,6 +33,12 @@ database, or the on-disk layout. Upgrading is a tag bump.
 
 ### Added
 
+- panel: DMARC guidance for send-only relays — the suggested `_dmarc` record
+  is now `p=none` without `rua=` by default; *Settings* and each domain page
+  let you configure an optional aggregate-report address (profile default plus
+  per-domain inherit / none / custom). When `rua=` targets another domain, the
+  panel shows and DNS-checks the hub's `_report._dmarc` authorisation record.
+  Domain export/import carries per-domain overrides.
 - `SECURITY.md` — how to report a vulnerability privately (GitHub private
   vulnerability reporting, `public@mixeme.ru` as fallback), which releases get
   fixes, and what is in and out of scope for a relay. No response time is
@@ -93,6 +105,12 @@ database, or the on-disk layout. Upgrading is a tag bump.
 
 ### Added
 
+- panel: DMARC guidance for send-only relays — the suggested `_dmarc` record
+  is now `p=none` without `rua=` by default; *Settings* and each domain page
+  let you configure an optional aggregate-report address (profile default plus
+  per-domain inherit / none / custom). When `rua=` targets another domain, the
+  panel shows and DNS-checks the hub's `_report._dmarc` authorisation record.
+  Domain export/import carries per-domain overrides.
 - A **Delivery log** on each delivery's page (`/deliveries/{id}`): the
   `mail.log` lines Postfix wrote about that message, oldest first — the
   connection to the receiving server, its reply, and the status that reply was
@@ -214,6 +232,12 @@ database, or the on-disk layout. Upgrading is a tag bump.
 
 ### Added
 
+- panel: DMARC guidance for send-only relays — the suggested `_dmarc` record
+  is now `p=none` without `rua=` by default; *Settings* and each domain page
+  let you configure an optional aggregate-report address (profile default plus
+  per-domain inherit / none / custom). When `rua=` targets another domain, the
+  panel shows and DNS-checks the hub's `_report._dmarc` authorisation record.
+  Domain export/import carries per-domain overrides.
 - A page per delivery (`/deliveries/{id}`), reached from the *Details* link on
   every send-log row. It carries what the log itself no longer shows — the
   sending domain, the application the message was submitted under, the Postfix
@@ -429,6 +453,12 @@ database, or the on-disk layout. Upgrading is a tag bump.
 
 ### Added
 
+- panel: DMARC guidance for send-only relays — the suggested `_dmarc` record
+  is now `p=none` without `rua=` by default; *Settings* and each domain page
+  let you configure an optional aggregate-report address (profile default plus
+  per-domain inherit / none / custom). When `rua=` targets another domain, the
+  panel shows and DNS-checks the hub's `_report._dmarc` authorisation record.
+  Domain export/import carries per-domain overrides.
 - Optional password encryption for the two secret-bearing downloads (plan
   phase 1.5, `docs/code-review.md`): an *Encrypt with a password* checkbox on
   the full-backup and domain-export forms writes a `.spbk` / `.spde` envelope
@@ -530,6 +560,12 @@ database, or the on-disk layout. Upgrading is a tag bump.
 
 ### Added
 
+- panel: DMARC guidance for send-only relays — the suggested `_dmarc` record
+  is now `p=none` without `rua=` by default; *Settings* and each domain page
+  let you configure an optional aggregate-report address (profile default plus
+  per-domain inherit / none / custom). When `rua=` targets another domain, the
+  panel shows and DNS-checks the hub's `_report._dmarc` authorisation record.
+  Domain export/import carries per-domain overrides.
 - The project's mark is now in use rather than only on file. The README opens
   with the full stamp; the panel carries the compact one at the left of its
   navigation bar, linking to the status page, and the full one above the card
@@ -762,6 +798,12 @@ of `docs/implementation-plan.md`).
 
 ### Added
 
+- panel: DMARC guidance for send-only relays — the suggested `_dmarc` record
+  is now `p=none` without `rua=` by default; *Settings* and each domain page
+  let you configure an optional aggregate-report address (profile default plus
+  per-domain inherit / none / custom). When `rua=` targets another domain, the
+  panel shows and DNS-checks the hub's `_report._dmarc` authorisation record.
+  Domain export/import carries per-domain overrides.
 - Panel (Go, single static binary) with SQLite persistence, one-time
   crypto-random setup link, bcrypt admin auth, session cookies.
 - Domain management with per-domain DKIM (RSA-2048, generated in pure Go) and