Domain and Email Hosting Onboarding

This procedure covers KareTech-managed email domains using Hostinger for mail delivery, Cloudflare for DNS, and Invoice Ninja for annual billing.

Standard annual pricing

Confirm the client, domain, scope and price before creating billing records.

Security rules

• Credentials belong in Infisical and must never be pasted into documentation or chat.
• Back up affected DNS records and record IDs before changing or deleting them.
• Do not expose Docker environment values wholesale.
• Do not email invoices or clients without explicit authorisation.
• Provide mailbox credentials through an approved secure channel.

Hostinger DNS records

All mail records are DNS-only in Cloudflare.

MX

SPF

Publish exactly one SPF policy. For a Hostinger-only sender:

v=spf1 include:_spf.mail.hostinger.com ~all

If another sender is already authorised, merge it into that policy instead of creating another SPF record.

DKIM

Each selector must resolve to exactly one value.

DMARC

Start new domains with one monitoring policy:

v=DMARC1; p=none

Tighten the policy only after SPF/DKIM alignment and real delivery are verified.

TXT content safety

Submit TXT values to the Cloudflare API as plain ASCII. Do not paste smart quotes such as “ or ”, and do not publish escaped UTF-8 byte strings. Multiple SPF or DMARC records are invalid even if each record looks plausible on its own.

DNS validation

Check Cloudflare authoritative nameservers and public resolvers:

DOMAIN="example.com"
for RESOLVER in <cloudflare-ns-1> <cloudflare-ns-2> 1.1.1.1 8.8.8.8; do
  dig +short @"$RESOLVER" MX "$DOMAIN"
  dig +short @"$RESOLVER" TXT "$DOMAIN"
  dig +short @"$RESOLVER" TXT "_dmarc.$DOMAIN"
  for S in a b c; do
    dig +short @"$RESOLVER" CNAME "hostingermail-$S._domainkey.$DOMAIN"
  done
done

Release only when:

• Both Hostinger MX records resolve.
• Exactly one SPF record exists.
• Exactly one DMARC record exists.
• Each Hostinger DKIM selector returns one value.
• No smart quotes or malformed duplicate TXT records remain.

Invoice Ninja SMTP

The verified transport for KareTech's Hetzner host is:

Do not use ports 465 or 25 from the KareTech Hetzner host; both are blocked. Port 587 is verified.

Invoice Ninja company-level SMTP settings override Laravel's global MAIL_* environment for company mail. Inspect both layers when troubleshooting.

Diagnostic order

1. Resolve smtp.hostinger.com from the host and container.
2. Test TCP 465, 587 and 25 at both boundaries.
3. If 587 connects, test STARTTLS and authentication without sending.
4. Check Invoice Ninja company-level SMTP fields for stale 465/SSL values.
5. Send one approved test message.
6. If SMTP accepts the message but the recipient does not receive it, investigate SPF, DKIM, DMARC, alignment and spam filtering.

A TCP timeout occurs before mailbox authentication and is not caused by Cloudflare DNS. DNS becomes relevant after the SMTP server accepts the message.

Invoice Ninja annual billing

1. Confirm the intended client and contact.
2. Search normal and recurring invoices for the domain to prevent duplicates.
3. Resolve the live currency by code/name. Never hard-code a historical currency ID.
4. Create an annual recurring template with frequency_id=6, remaining_cycles=-1, and auto_bill=off.
5. Activate it with the supported bulk start action.
6. Create the initial annual invoice when required.
7. For manual forwarding, mark it sent for bookkeeping without invoking email, download the PDF, and provide it to Kareem.
8. Do not send, mark paid, void or alter balances without explicit instruction.

Handover checklist

• Domain ownership and renewal responsibility confirmed.
• Existing mail migration risk assessed.
• DNS backup captured.
• Hostinger ownership TXT verified if required.
• MX, single SPF, single DMARC and all DKIM values verified.
• Invoice Ninja uses 587/STARTTLS with peer verification.
• Outbound and inbound delivery tests pass.
• Duplicate billing checks complete.
• Live currency resolved.
• Credentials delivered securely.
• Changelog and service documentation updated.

Incident reference

On 31 July 2026, Invoice Ninja reset email failed because company-level SMTP retained Hostinger 465/SSL while the Hetzner host blocked port 465. The repair moved SMTP to 587/STARTTLS and enabled peer verification. A separate DNS audit found duplicate/malformed SPF, DMARC and legacy DKIM records; they were backed up, consolidated and verified through authoritative and public resolvers.