fix(mail): expect SES MAIL FROM MX on amazonses.com

[Frtrillo]

Summary

• SES SMTP submission is email-smtp.{region}.amazonaws.com.
• Custom MAIL FROM bounce MX is feedback-smtp.{region}.amazonses.com (AWS regional SES endpoints).
• OpenShip derived the MAIL FROM MX from the SMTP suffix, so Health warned on a correctly published SES record (amazonses.com vs expected amazonaws.com).

Changes

• packages/core: SES mailFrom.mxTemplate now uses amazonses.com. Comment documents why the SMTP and bounce hostnames must stay on different suffixes.
• Tests: Registry fixture and DNS-scan SES MX fixture follow the documented hostname. Added a regression that SMTP host and MAIL FROM MX suffixes must not be folded together.

Do not change live DNS to silence the old warning. Operators who already published feedback-smtp.{region}.amazonses.com (the AWS console value) are correct.

PTR on EC2 (ec2-…compute.amazonaws.com vs mail.example.com) is a separate, expected warning while outbound is relayed and is not part of this PR.

Test plan

• packages/core relay-provider tests: 15 passed
• apps/api DNS-scan tests: 33 passed
• Health → DNS scan on an SES relay with custom MAIL FROM should Pass the MAIL FROM MX row when it points at feedback-smtp.{region}.amazonses.com
• DNS tab recommended MX should show amazonses.com, not amazonaws.com

Made with Cursor