# SendGrid Rebuild Guide
**Cold Bore Ballistics LLC — Confidential**
Last updated: 2026-06-06

> Full from-scratch rebuild of the CBB SendGrid account. Follow this guide if the account is lost, compromised, or needs to be transferred. For current account state, see `SendGrid_Architecture_Reference.md`. For day-to-day operations, see `SendGrid_Operating_Runbook.md`.

---

## Prerequisites

Before starting:
- Access to `admin@coldboreballisticsllc.com` inbox (for account verification email)
- Access to Namecheap CBB account (`coldboreballistics` login) — DNS records must be added
- The `twilio-ivr` key value will need to be set in the Twilio Function after rebuild — have Azure Key Vault access ready
- Estimated time: 30–45 minutes (plus DNS propagation, up to 1 hour)

---

## Step 1 — Create a New SendGrid Account

1. Go to `https://sendgrid.com` and click **Start for Free**
2. Sign up with `admin@coldboreballisticsllc.com`
3. Choose the **Free** plan (100 emails/day — sufficient at launch scale)
4. Verify the email address when the confirmation email arrives
5. Complete the account setup questionnaire:
   - Company: Cold Bore Ballistics LLC
   - Website: `https://www.coldboreballisticsllc.com`
   - Use case: Transactional — system notifications and voicemail delivery
   - Volume: Under 100/day

---

## Step 2 — Authenticate the CBB Corporate Domain

Domain authentication proves to email providers that SendGrid is authorized to send on behalf of `coldboreballisticsllc.com`. This is required for reliable delivery.

1. In the SendGrid Console, navigate to **Settings → Sender Authentication**
2. Click **Authenticate Your Domain**
3. Select DNS host: **Other** (you will add records manually in Namecheap)
4. Enter domain: `coldboreballisticsllc.com`
5. Subdomain: `em` (accept default)
6. Leave **Use automated security** checked
7. Click **Next** — SendGrid will display three CNAME records

Add all three CNAME records to Namecheap (CBB account):

| Host | Type | Value (format — actual values from SendGrid UI) |
|---|---|---|
| `em.coldboreballisticsllc.com` | CNAME | `u<userID>.wl<NNN>.sendgrid.net` |
| `s1._domainkey.coldboreballisticsllc.com` | CNAME | `s1.domainkey.u<userID>.wl<NNN>.sendgrid.net` |
| `s2._domainkey.coldboreballisticsllc.com` | CNAME | `s2.domainkey.u<userID>.wl<NNN>.sendgrid.net` |

> The exact values depend on the new account's user ID. Copy them exactly from the SendGrid UI — do not use values from the previous account.

After adding DNS records, click **Verify** in SendGrid. DNS propagation can take up to 1 hour. If verification fails, wait 15 minutes and retry.

8. Set this domain as the **default** sender domain.
9. Record the domain ID from the URL (`/whitelabel/domains/<id>`) — update `SendGrid_Architecture_Reference.md`.

---

## Step 3 — Authenticate the ScopeDOPE Domain

Repeat Step 2 for `scope-dope.com`:

1. **Settings → Sender Authentication → Authenticate Your Domain**
2. Domain: `scope-dope.com`, subdomain: `em`, **default: No**
3. Add the three CNAME records to Namecheap CBB account under `scope-dope.com`
4. Verify
5. Record the domain ID — update `SendGrid_Architecture_Reference.md`

---

## Step 4 — Configure Mail Settings

1. Navigate to **Settings → Mail Settings**
2. Set the following:

| Setting | Value |
|---|---|
| Click Tracking | **Disabled** |
| Open Tracking | **Disabled** |
| Bounce Forwarding | **Enabled** → `admin@coldboreballisticsllc.com` |
| Subscription Tracking | **Disabled** |
| Google Analytics | **Disabled** |

---

## Step 5 — Create API Keys

### `claude-code-cli` key (Full Access — operator use)

1. **Settings → API Keys → Create API Key**
2. Name: `claude-code-cli`
3. Select **Full Access**
4. Click **Create & View**
5. Copy the key immediately — it is shown only once
6. Store in Azure Key Vault:
```bash
az keyvault secret set \
  --vault-name kv-cbb-shared-prod \
  --name sendgrid-claude-code-cli-secret \
  --value "<key-value>"
```

### `twilio-ivr` key (Mail Send only — IVR Function)

1. **Settings → API Keys → Create API Key**
2. Name: `twilio-ivr`
3. Select **Restricted Access** → **Mail Send → Full Access**
4. Click **Create & View**
5. Copy the key immediately
6. Store in Azure Key Vault:
```bash
az keyvault secret set \
  --vault-name kv-cbb-shared-prod \
  --name sendgrid-twilio-ivr-secret \
  --value "<key-value>"
```

---

## Step 6 — Update the Twilio Function Environment Variable

The IVR Function reads the SendGrid key from its environment variables at runtime. After a key rebuild, update it:

```bash
# Retrieve the new key from Key Vault
NEW_KEY=$(az keyvault secret show \
  --vault-name kv-cbb-shared-prod \
  --name sendgrid-twilio-ivr-secret \
  --query value --output tsv)

# Update the Function environment variable
# Variable SID ZV200e9a3e467bd88ae1f6aea01dcd915e is the SENDGRID_API_KEY var
# Auth against ScopeDOPE subaccount (retrieve auth token from kv-scope-dope-prod)
TWILIO_AUTH=$(az keyvault secret show \
  --vault-name kv-scope-dope-prod \
  --name twilio-scopedope-auth-token \
  --query value --output tsv)

curl -s -X POST \
  "https://serverless.twilio.com/v1/Services/ZSfb518af22cef2c341dccd311a4d29d81/Environments/ZEa0ad80e6327ffb7bb3a3bb31db28469c/Variables/ZV200e9a3e467bd88ae1f6aea01dcd915e" \
  -u "AC7cc6b6571c9b0907b73b783a5422a2c4:$TWILIO_AUTH" \
  --data-urlencode "Value=$NEW_KEY"
```

Then redeploy the Function — see `Twilio_Rebuild_Guide.md` for Function redeploy steps.

---

## Step 7 — Verify End-to-End

Send a test email using the `twilio-ivr` key to confirm delivery:

```bash
SG_KEY=$(az keyvault secret show \
  --vault-name kv-cbb-shared-prod \
  --name sendgrid-twilio-ivr-secret \
  --query value --output tsv)

curl -s -X POST "https://api.sendgrid.com/v3/mail/send" \
  -H "Authorization: Bearer $SG_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "personalizations": [{"to": [{"email": "jason@coldboreballisticsllc.com"}]}],
    "from": {"email": "noreply@scope-dope.com", "name": "ScopeDOPE IVR"},
    "subject": "[Test] SendGrid rebuild verification",
    "content": [{"type": "text/plain", "value": "SendGrid rebuild complete — delivery confirmed."}],
    "headers": {
      "X-CBB-Source": "twilio-ivr",
      "X-CBB-Called": "rebuild-test",
      "X-CBB-Category": "test",
      "X-CBB-Option": "test"
    }
  }'
```

A 202 response with no body = accepted. Check `jason@coldboreballisticsllc.com` inbox for delivery.

---

## Step 8 — Update Documentation

1. **`SendGrid_Architecture_Reference.md`** — update:
   - Account User ID (new account will have a different ID)
   - API key IDs for both keys
   - Domain IDs for both authenticated domains
   - DNS record values (new account = new subdomain values)
   - Last updated date and status line

2. **`ONEDRIVE_ORGANIZATION_GUIDE.md`** — no change needed unless new domains are added

3. **`Twilio_Architecture_Reference.md`** — no change needed (references Key Vault names, not key values)

---

## Rebuild Time Estimate

| Step | Time |
|---|---|
| Account creation | 5 min |
| Domain authentication (both domains) | 10 min setup + up to 60 min DNS propagation |
| Mail settings | 2 min |
| API key creation + vault storage | 10 min |
| Twilio Function env var update | 5 min |
| End-to-end verification | 5 min |
| Documentation update | 10 min |
| **Total (excluding DNS wait)** | **~45 min** |

---

## Document Control

| Field | Value |
|---|---|
| **Document owner** | `jschwefel@coldboreballisticsllc.com` |
| **Classification** | Confidential (03_-_Confidential/) |
| **Location** | `OneDrive/CBB_Corporate/03_-_Confidential/Infrastructure/SendGrid/SendGrid_Rebuild_Guide.md` |
| **Cross-references** | `SendGrid_Architecture_Reference.md`; `SendGrid_Operating_Runbook.md` |
| **Created** | 2026-06-06 |
| **Last updated** | 2026-06-06 |
| **Next full review due** | 2027-06-06 |

---

## Revision Control Block

| Rev | Date | Changed By | Reviewed By | Approved By | Summary |
|-----|------|------------|-------------|-------------|---------|
| 0.9 | 2026-06-06 | jschwefel | — | — | Initial release |
