fix: reuse an existing SES identity when adding a domain
Adding a domain whose SES identity already existed failed outright with AlreadyExistsException, and there was no way back: addDomain is not atomic, so a create that failed after the identity was made left it orphaned in SES with no domain row, and deleteDomain works from a row. Every retry hit the error again.
Adopt the identity instead. When it already signs with a recoverable BYODKIM key, take the selector from DkimAttributes.Tokens and read the public key back out of the record it publishes, so DNS that is already in place keeps working. Otherwise rotate in a fresh keypair, which needs the DKIM record republished but does complete.
Adopting an identity also rewrites its MAIL FROM domain, so refuse when one is already set to something else rather than silently redirecting mail from an existing setup.
Domains now store the selector they actually sign with rather than assuming "usesend".
Summary by cubic
Fixes adding a domain whose SES identity already exists, which previously failed with AlreadyExistsException and left an orphaned identity with no way to retry.
- Adopts the existing identity, reusing its DKIM key when the published record is recoverable so existing DNS keeps working.
- Rotates in a new keypair when the DKIM key can't be recovered, which requires republishing the DKIM record.
- Refuses to reuse an identity whose MAIL FROM domain differs from
mail.<domain>to avoid silently redirecting mail. - Domains now store the selector they actually sign with rather than assuming
usesend.
Summary by CodeRabbit
-
Bug Fixes
- Improved domain setup when an email identity already exists.
- Preserves existing email delivery configurations when safely reusable.
- Prevents reuse when the configured MAIL FROM domain is incompatible.
- Retains or refreshes DKIM signing details as needed.
-
Improvements
- Stores the DKIM selector associated with the configured email identity for more reliable domain verification.