• wraps email destroy deletes only the records Wraps created. Every deletion matches name, type and exact value, and a Route53 record set holding values Wraps did not write is rewritten without Wraps’ value rather than deleted whole — deletion previously matched name and type alone, so accepting the DNS cleanup prompt on a domain that already had a _dmarc policy removed that policy along with the records Wraps wrote. Cloudflare and Vercel domains are cleaned up too, not just Route53, and the record lookup is paginated so zones larger than 500 record sets no longer skip records silently. If you ran destroy before this and the domain had a _dmarc policy predating Wraps, confirm it is still published
• wraps email reply destroy deletes the MX and SPF records it created at r.mail.<domain> instead of printing a reminder to remove them by hand — left in place, the MX still pointed at SES with nothing configured to receive, so signed reply addresses bounced. wraps email inbound destroy now warns when reply threading is configured, and still never deletes those records itself: they follow the sending domain, not the inbound receiving domain
• Fix: a DNS write that correctly did nothing is no longer reported as a failure. Re-running wraps email inbound init, inbound add or reply init against records that were already correct used to print the full manual SPF block, and following it against an existing SPF record produced a second v=spf1 record — the RFC 7208 PermError the preflight exists to prevent
• Fix: wraps email check recommends ~all and no longer grades a domain down for it. A -all deduction now applies only where the domain authorizes senders and DMARC is absent, invalid, p=none or t=y — RFC 9989 section 7.1 cautions against -all because it rejects mail pre-DATA, before DMARC can pass it on an aligned DKIM signature — and a parked v=spf1 -all is never flagged

CLI v3.11.1