Add nextsurplus.com email-authentication template

[bmoss2015]

Description

Adds a new template for nextsurplus.com (service email-authentication).

Next Surplus is a multi-tenant B2B SaaS CRM. This template lets customers connect their own business domain in 2-3 clicks so their outbound customer email passes SPF, DKIM, MX return-path, and DMARC checks at Gmail, Yahoo, Outlook, and other major mailbox providers. Standard SaaS use case; no bulk marketing or consumer sends.

Corrections vs. the initial submission:

• TXT records now use data (was pointsTo)
• SPF now uses SPFM type with spfRules (was TXT with pointsTo)
• DMARC has txtConflictMatchingMode: Prefix and essential: OnApply per the guidelines
• syncPubKeyDomain: nextsurplus.com set (RSA-2048 public key published at https://nextsurplus.com/.well-known/domain-connect/dc-signing-pub-key.pem, verified 200 OK)

Type of change

• New template
• Bug fix (non-breaking change which fixes an issue in the template)
• New feature (non-breaking change which adds functionality to the template)
• Breaking change (fix or feature that would cause existing template behavior to be not backward compatible)

How Has This Been Tested?

• Template functionality checked using Online Editor — see test links below
• Template file name follows the pattern <providerId>.<serviceId>.json
• resource URL provided with logoUrl is actually served by a webserver

Checklist of common problems

• syncPubKeyDomain is set — set to nextsurplus.com. Public key published at https://nextsurplus.com/.well-known/domain-connect/dc-signing-pub-key.pem (RSA-2048, verified 200 OK).
• warnPhishing is not set alongside syncPubKeyDomain — warnPhishing is not set; only syncPubKeyDomain is set
• syncRedirectDomain is set whenever the template uses redirect_uri in the synchronous flow — this template does not use redirect_uri, so syncRedirectDomain is not needed
• no TXT record contains SPF content ("v=spf1 ...") — SPF uses SPFM record type
• txtConflictMatchingMode is set on every TXT record that must be unique per label or content prefix — set on DMARC record
• no variable is used as a bare full record value — DKIM value uses %dkimPublicKey% as full record data because that is the entire DKIM public key format; standard practice for DKIM templates (see arkhq.io.email-sending.json, aurorasendcloud.com.email-auth.json)
• no bare variable is used as the full host label — DKIM host uses %dkimSelector%._domainkey with the fixed ._domainkey suffix
• no variable is used in the host field to create a subdomain
• %host% does not appear explicitly in any host attribute
• essential is set to OnApply on records the end user may need to modify or remove — set on DMARC record

Online Editor test results

Editor test link(s):

• Test nextsurplus.com/email-authentication example.com/@
• Test nextsurplus.com/email-authentication example.com/app

[github-actions]

✅ JSON Filename Check Passed

[github-actions]

✅ JSON Schema Validation Passed

[github-actions]

Linter OK

nextsurplus.com.email-authentication.json

Level	Code	Note

[bmoss2015]

Online Editor test results

Editor test link(s):

• Test nextsurplus.com/email-authentication example.com/@
• Test nextsurplus.com/email-authentication example.com/app

[github-actions]

PR Description Check Passed

All required sections are filled in correctly.

Details

  OK  Type of change: 1/4 checkboxes ticked
  OK  How Has This Been Tested?: all 3 checkboxes ticked
  OK  Checklist of common problems: 10/10 checkboxes ticked
  OK  Online Editor test results: 2 link(s) found
  OK  Template coverage: all 1 template(s) covered
Labels to remove: Checklist of common problems not complete, Forged editor links, PR description incomplete, Test links missing

PR description check PASSED

[bmoss2015]

Polite bump — this PR has been sitting for 48 hours and is ready for review. All CI checks pass (linter, schema validation, description check, online editor test link posted). Happy to make any adjustments needed. Thanks for your time!