# DNS change sheet — inference.coop

**Rebuilt 2026-11-01 from the registrar's own panel** (domains.coop; nameservers `ns1/ns2.yoursrs.com`).
The previous version listed record counts that could not be reproduced and at least two records that did
not exist, so it is replaced rather than edited.

## Why the panel was the only source

- **AXFR is refused**, so the zone cannot be pulled.
- **The zone is wildcarded.** A made-up hostname (`zz-random-check-9f2.inference.coop`) returns the old
  box's address. So a name that *resolves* proves nothing about whether a record exists, and any hostname
  absent from the list below is served by the wildcard.
- Only 11 records exist. Everything else is `*`.

## The complete inventory (11 records)

| # | Type | Hostname | Value | TTL | Moves? |
|---|------|----------|-------|-----|--------|
| 1 | A | `inference.coop` | `179.199.135.72` | 3600 | **YES** → new box |
| 2 | AAAA | `inference.coop` | `2a02:4780:6e:83fd::1` | 3600 | **YES** → new box |
| 3 | A | `*` | `179.199.135.72` | 3600 | **YES** → new box |
| 4 | AAAA | `*` | `2a02:4780:6e:83fd::1` | 3600 | **YES** → new box |
| 5 | A | `server` | `179.199.135.72` | 3600 | **CHECK FIRST** — nothing else references it |
| 6 | A | `www` | `179.199.135.72` | 3600 | **YES** → new box |
| 7 | MX (pri 10) | `inference.coop` | `my.inference.coop` | 3600 | stays (follows record 1/2) |
| 8 | TXT | `inference.coop` | `v=spf1 a:my.inference.coop include:_spf.tem.scaleway.com ~all` | 3600 | stays |
| 9 | TXT | `_dmarc` | `v=DMARC1; p=reject; pct=100` | 3600 | stays |
| 10 | TXT | `cloudron._domainkey` | `v=DKIM1; t=s; p=MIGfMA0GCSqGSIb3…` (1024-bit; full value recovered 2026-11-01 and restored) | 3600 | stays |
| 11 | TXT | `ede94f37-204c-41ee-b3…` | `v=DKIM1; h=sha256; k=rsa; p=MIIBIjA…` (2048-bit) | 3600 | stays |
| 12 | TXT | `_atproto` | `did=did:plc:4leras5objxiqtnbjzoholds` | 3600 | stays |

(The table shows 12 rows because `www` was added as a separate item; rows 1–11 are the panel's 11.
Reconcile the numbering against the panel when editing.)

## The four records that matter at cutover

**Records 1–4 and 6**: apex A, apex AAAA, wildcard A, wildcard AAAA, and `www`. Change these and the site
moves. Nothing else in the zone needs touching for the migration.

**The wildcards are the item the old sheet omitted entirely.** Because `*` carries both A and AAAA records,
every hostname not listed above — `chat`, `portal`, `panel`, `dashboard`, `newsletter`, `gateway`,
`vault`, `git`, `registry`, `files`, `forum`, `email`, `docs`, `my`, `status` — resolves *only* via the
wildcard. They are not individual records and must not be created as such; they move when the wildcards
move. A partial cutover that changes the apex but not `*` leaves every application on the old box.

## Two DKIM selectors, for different senders

- **`cloudron._domainkey`** — the box's own mail signing (1024-bit). Used by the portal and by Listmonk,
  both of which relay through the Cloudron mail app.
- **`ede94f37-…`** — a UUID-named selector with a 2048-bit key. UUID selectors are what a service
  generates for itself, and this is almost certainly **Scaleway Transactional Email's**. Scaleway's own
  domain verification passed, which is the authority on whether it is right.

*Name and value for row 11 are truncated in the panel screenshot. Read the full name in the panel (or
from Scaleway's domain-verification page) before editing that row.*

## What the zone does NOT contain

No CNAME, no CAA, no SRV, no `_acme-challenge` entries. If any of those are ever needed, they are new
records, not moves. (`docs.inference.coop` has no record of its own — it is served by the wildcard, which
is why it answers with the Cloudron dashboard.)

## Before the window

1. **Lower the TTL on records 1–4 and 6 from 3600 to ~300.** At 3600 a mistake takes an hour to correct;
   at 300 it takes five minutes. Do this a day ahead so the old TTL expires, then restore it afterwards.
2. ~~**Establish what `server.inference.coop` is used for.**~~ **Resolved 2026-11-02:** it was repointed
   to the new box with the rest (confirmed authoritatively on both NS). Its purpose is still
   unidentified, but it no longer references the old box — see the runbook's CUTOVER COMPLETE section.
3. **Confirm the full name of record 11** (above).

## Verification after the move

Query the **authoritative** nameservers, not a resolver, and query the specific name — a wildcard answer
cannot be distinguished from a real record otherwise:

```
dig +short A    inference.coop        @ns1.yoursrs.com
dig +short AAAA inference.coop        @ns1.yoursrs.com
dig +short A    zz-random-check-9f2.inference.coop @ns1.yoursrs.com   # wildcard, must now be the NEW box
dig +short MX   inference.coop        @ns1.yoursrs.com
```

Then `verify-restore.py`. Its two known blind spots (the `data` group crashing on a missing PATH, and the
mail check asserting a port-25 state it cannot observe from the agent host) are still unfixed — fix them
before relying on a clean run.