BaseScan Email Remediation

GCA Domain Email Setup Plan

This page records the owner-controlled domain email evidence for the next BaseScan token profile submission. The support@gcagochina.com mailbox is active, DNS authentication is published, public contact values are aligned, and profile publication still depends on BaseScan review.

BaseScan Remediation Evidence Checklist Support Page Tim Chen Profile Listing Kit
Current Public Email support@gcagochina.com
Target Domain Email support@gcagochina.com
Readiness Active
BaseScan Gate Ready for resubmission

Setup Checklist

Mailbox typeUse a hosted mailbox that can receive mail and send authenticated mail as support@gcagochina.com.
DNS recordsAdd the provider's MX, SPF, DKIM, and DMARC records at the DNS host for gcagochina.com.
Inbound testSend a test message from Gmail or Outlook to support@gcagochina.com and confirm it arrives.
Outbound testReply from support@gcagochina.com to Gmail or Outlook and confirm the sender displays the domain email.
Website switchPublic support and BaseScan submission email values now use the domain email.

Current Boundary

The mailbox is live, public pages show support@gcagochina.com as the active contact, and BaseScan resubmission materials now use the same sender and website email.

Do not claimBaseScan token profile approval before BaseScan publishes it.
Do not submit duplicatesUse one clean BaseScan update from support@gcagochina.com and wait for reviewer response.
Safe claimDomain email evidence is ready for owner resubmission.

Provider Selection Gate

Choose A Full Mailbox, Not Receive-Only Routing

For BaseScan, the practical requirement is not only receiving mail at the project domain. The owner should be able to send and reply as support@gcagochina.com with authenticated domain mail.

Minimum acceptableA hosted mailbox or mail service that supports inbound mail, authenticated outbound sending, MX, SPF, DKIM, and DMARC for gcagochina.com.
Receive-only is not enoughCloudflare Email Routing can be useful for forwarding inbound mail, but receive-only forwarding alone does not prove outbound sender alignment for a BaseScan resubmission.
Common full-mailbox pathsGoogle Workspace, Microsoft 365, Zoho Mail, or another hosted mailbox provider are acceptable only if the exact provider DNS records pass and outbound replies visibly come from support@gcagochina.com.
Decision rulePick the cheapest option that gives a real mailbox UI or SMTP/API sending path for support@gcagochina.com; do not switch the public site until both receiving and sending tests pass.

Reference docs for operator setup: Cloudflare Email Routing, Google Workspace MX setup, Microsoft 365 custom domain setup, and Zoho Mail custom domain setup.

Provider Decision Matrix

Pick The Lowest-Cost Full Mailbox That Passes Evidence Gates

Use the local provider matrix before buying a mailbox plan. It does not fetch live prices or guess DNS records; it separates full mailbox options from receive-only or send-only paths that are not enough for a clean BaseScan resubmission.

Recommended first checkZoho Mail or an equivalent low-cost hosted mailbox, only if it creates support@gcagochina.com and provides MX, SPF, DKIM, and DMARC setup.
Also acceptableGoogle Workspace or Microsoft 365 if the owner prefers those ecosystems and outbound replies visibly send from support@gcagochina.com.
Not enough aloneCloudflare Email Routing only, or any send-only SMTP/API service without inbound mail for the same address.
Matrix commandpython3 tools/build_domain_email_provider_matrix.py --markdown
Owner artifactpython3 tools/build_domain_email_provider_matrix.py --output-json launch/domain_email_provider_matrix.json --output-md launch/domain_email_provider_matrix.md
DNS entry packetpython3 tools/build_domain_email_dns_entry_packet.py --provider <provider-name> --mx "10 <provider-mx>" --spf "v=spf1 include:<provider> ~all" --dkim-selector <provider-selector> --dkim-type TXT --dkim-value "<provider-dkim-value>" --dmarc "v=DMARC1; p=none;" --output-json launch/domain_email_dns_entry_packet.json --output-md launch/domain_email_dns_entry_packet.md

Owner Gate

Owner Action Packet: Do These In Order Before BaseScan

This is the short execution path for the owner before one clean BaseScan resubmission. Stop immediately if a step cannot be proven; public email values should remain aligned to support@gcagochina.com.

1. Confirm mailboxConfirm support@gcagochina.com can still receive external mail and send authenticated replies from the same address.
2. Keep provider proofKeep domain-email-provider-active.png showing support@gcagochina.com as active or verified in the provider dashboard.
3. Keep DNS worksheetKeep the DNS entry packet with the provider's exact MX, SPF, DKIM, and DMARC values for owner records.
4. Confirm DNS recordsConfirm MX, one merged SPF TXT, DKIM with the zmail selector, and DMARC at _dmarc still pass.
5. Verify DNSRun python3 tools/check_domain_email_dns.py --domain gcagochina.com --mailbox support --dkim-selector zmail --json and save domain-email-dns-mx-spf-dkim-dmarc.txt.
6. Keep mail proofKeep inbound and outbound screenshots: domain-email-inbound-test.png and domain-email-outbound-test.png.
7. Confirm public emailConfirm public support/BaseScan values already show support@gcagochina.com, then keep support-page-domain-email.png.
8. Final preflightRun python3 tools/check_basescan_resubmission_readiness.py --json --require-ready. BaseScan can be resubmitted only when it reports ready.
Stop conditionIf any evidence file becomes missing, DNS readiness regresses, outbound sender is not support@gcagochina.com, or the preflight fails, pause and fix the evidence before resubmitting.

DNS Record Gate

Records To Copy From The Mail Provider

MX

Routes incoming mail for gcagochina.com to the mailbox provider. Use the exact host, priority, and value from the provider dashboard.

SPF

TXT record that authorizes the provider to send email for the domain. Keep one SPF TXT record and merge provider values if needed.

DKIM / DMARC

DKIM proves message signing. DMARC can start with monitoring mode, then become stricter after mail delivery is stable.

Operator DNS Check

After records are added, run python3 tools/check_domain_email_dns.py --domain gcagochina.com --mailbox support --dkim-selector <provider-selector> --json. This is a read-only public DNS check for MX, SPF, DMARC, and DKIM.

DNS Entry Packet Builder

Before entering DNS records, run python3 tools/build_domain_email_dns_entry_packet.py with the provider's exact MX, SPF, DKIM, and DMARC values. It generates a local copyable packet and does not write DNS records.

Evidence Packet Builder

First run python3 tools/build_domain_email_evidence_packet.py --init-evidence-dir --evidence-dir launch/domain_email_evidence to create the local checklist. After DNS and manual mail tests pass, save the five proof files in launch/domain_email_evidence, then run python3 tools/build_domain_email_evidence_packet.py --dkim-selector <provider-selector> --evidence-dir launch/domain_email_evidence --website-email-updated --output-json launch/domain_email_evidence_packet.json --output-md launch/domain_email_evidence_packet.md. The packet blocks BaseScan resubmission until DNS, screenshots, and website email alignment are complete.

Public Switch Checker

After the public files are manually switched, run python3 tools/check_domain_email_public_switch.py --json --require-switched. It blocks if any critical support, project, or BaseScan file still publishes the old Outlook contact instead of support@gcagochina.com.

Snapshot Alignment Checker

Before reusing BaseScan or platform reply copy, run python3 tools/check_domain_email_snapshot_alignment.py --json --require-aligned. It checks public site, launch, and docs materials against the canonical liveDnsSnapshot in domain-email.json and blocks stale DNS snapshot dates.

DNS Entry Worksheet

Fields To Fill At The DNS Host

Use this worksheet when the mailbox provider shows DNS instructions. Copy provider values exactly; do not guess mail server hosts, DKIM selectors, or verification strings.

MXType: MX. Name/host: @ or gcagochina.com. Value and priority: copy from the provider dashboard. Ready check: MX present for gcagochina.com.
SPFType: TXT. Name/host: @ or gcagochina.com. Value source: provider SPF string. Ready check: one root-domain v=spf1 TXT record; merge includes instead of creating multiple SPF records.
DKIMType: TXT or CNAME, exactly as the provider requires. Name/host: provider selector such as <selector>._domainkey. Ready check: rerun the DNS checker with --dkim-selector <provider-selector>.
DMARCType: TXT. Name/host: _dmarc. Starter value can use monitoring mode, for example v=DMARC1; p=none;, until delivery is stable. Ready check: DMARC present at _dmarc.gcagochina.com.
EvidenceAfter records propagate, save provider status, DNS lookup proof, inbound mail proof, outbound mail proof, and updated support-page proof before BaseScan resubmission.

Live DNS Snapshot

2026-05-30 Read-Only DNS Check

The current public DNS check is ready for BaseScan email evidence. This snapshot only records what public DNS returns; it does not write DNS records, send email, submit BaseScan forms, or touch wallets/contracts.

MX PresentZoho MX records are visible for gcagochina.com, so inbound mail to support@gcagochina.com is routed.
SPF PresentThe root-domain SPF TXT record authorizes Zoho Mail.
DMARC PresentThe _dmarc.gcagochina.com monitoring policy is visible.
DKIM PresentThe zmail._domainkey.gcagochina.com DKIM TXT record is visible and the read-only checker passes.
ReadinessReady for BaseScan email evidence.
Next actionKeep the mailbox active, retain provider/DNS/inbound/outbound evidence privately, and use support@gcagochina.com for one clean BaseScan resubmission.

Evidence Packet

What To Save Before BaseScan Resubmission

After the mailbox is active, keep a small evidence packet so the next BaseScan request can prove that the sender email, website contact email, and domain ownership path match.

Provider statusSave a screenshot showing support@gcagochina.com as verified or active in the mail provider dashboard.
DNS proofSave MX, SPF, DKIM, and DMARC lookup results after propagation completes.
Inbound proofSave a test email sent from Gmail or Outlook to support@gcagochina.com, including the received timestamp.
Outbound proofSave a reply from support@gcagochina.com back to Gmail or Outlook, showing the visible sender address.
Website proofSave the updated support page showing the same domain email used in the BaseScan form, for example support-page-domain-email.png.
Local packetGenerate launch/domain_email_evidence_packet.json and launch/domain_email_evidence_packet.md only after the five evidence files exist.
Public checklistUse domain-email-evidence.html as the public, reviewer-safe checklist while keeping mailbox screenshots and proof files private.

After Activation

Pages And Files To Update

Public supportsupport.html, support.json, zh-support.html, register.html, and member intake pages.
BaseScan packagebasescan-remediation.html, basescan-remediation.json, launch/basescan_form_values.json, and launch/basescan_resubmission_values.json.
Project identityproject.json, listing-kit.html, reviewer-kit.json, and external review status files.
ValidationRun tools/check_domain_email_dns.py, then run the public site checks and send the next BaseScan request from the same domain email where possible.

Current Preflight Snapshot

0 Critical Files Still Publish The Old Outlook Email

The latest read-only BaseScan preflight shows that the public switch is complete. Support, website, BaseScan package, and reviewer-facing files now publish support@gcagochina.com.

Support and intakesite/support.html, site/support.json, site/zh-support.html, site/register.html, and site/members.html.
Project and listingsite/project.json, site/listing-kit.html, site/reviewer-kit.json, site/basescan-remediation.html, site/basescan-remediation.json, and site/external-reviews.json.
Launch packetslaunch/basescan_form_values.json, launch/basescan_resubmission_values.json, launch/basescan_resubmission_package.md, launch/external_review_followup_tracker.json, and launch/external_review_followup_tracker.md.
Public switchThe critical files report zero old-email occurrences and remain aligned to support@gcagochina.com.
Final checkAfter switching, tools/check_domain_email_public_switch.py --json --require-switched must report zero old-email files before a BaseScan resubmission package is prepared.

Switch Plan Generator

Find Every Public Email Reference Before Switching

After support@gcagochina.com is active and the evidence packet is ready, run the read-only switch planner before changing public files. It scans public site, launch, docs, and the member backend contact constant for old-email references.

JSON planpython3 tools/build_domain_email_switch_plan.py --json
Markdown planpython3 tools/build_domain_email_switch_plan.py --markdown
Patch previewpython3 tools/build_domain_email_switch_plan.py --patch. This prints an exact replacement diff only; it does not apply changes.
Owner artifactpython3 tools/build_domain_email_switch_plan.py --output-json launch/domain_email_switch_plan.json --output-md launch/domain_email_switch_plan.md
Patch artifactpython3 tools/build_domain_email_switch_plan.py --output-patch launch/domain_email_switch_preview.patch
Readiness checkpython3 tools/check_domain_email_public_switch.py --json --require-switched
BoundaryThe planner does not edit files, send email, write DNS, submit BaseScan requests, or touch wallets/contracts.

BaseScan Resubmission Gate

Ready Means All Five Are True

Submission policy: send the next clean BaseScan update from support@gcagochina.com and keep private mailbox evidence ready if the reviewer asks for it.