runbooks/dns-change-sheet.md

DNS change sheet — inference.coop

Rebuilt 2026-11-01 from the registrar's own panel (domains.coop; nameservers ns1/ns2.yoursrs.com). The previous version listed record counts that could not be reproduced and at least two records that did not exist, so it is replaced rather than edited.

Why the panel was the only source

• AXFR is refused, so the zone cannot be pulled.
• The zone is wildcarded. A made-up hostname (zz-random-check-9f2.inference.coop) returns the old box's address. So a name that resolves proves nothing about whether a record exists, and any hostname absent from the list below is served by the wildcard.
• Only 11 records exist. Everything else is *.

The complete inventory (11 records)

#	Type	Hostname	Value	TTL	Moves?
1	A	inference.coop	179.199.135.72	3600	YES → new box
2	AAAA	inference.coop	2a02:4780:6e:83fd::1	3600	YES → new box
3	A	*	179.199.135.72	3600	YES → new box
4	AAAA	*	2a02:4780:6e:83fd::1	3600	YES → new box
5	A	server	179.199.135.72	3600	CHECK FIRST — nothing else references it
6	A	www	179.199.135.72	3600	YES → new box
7	MX (pri 10)	inference.coop	my.inference.coop	3600	stays (follows record 1/2)
8	TXT	inference.coop	v=spf1 a:my.inference.coop include:_spf.tem.scaleway.com ~all	3600	stays
9	TXT	_dmarc	v=DMARC1; p=reject; pct=100	3600	stays
10	TXT	cloudron._domainkey	v=DKIM1; t=s; p=MIGfMA0GCSqGSIb3… (1024-bit; full value recovered 2026-11-01 and restored)	3600	stays
11	TXT	ede94f37-204c-41ee-b3…	v=DKIM1; h=sha256; k=rsa; p=MIIBIjA… (2048-bit)	3600	stays
12	TXT	_atproto	did=did:plc:4leras5objxiqtnbjzoholds	3600	stays

(The table shows 12 rows because www was added as a separate item; rows 1–11 are the panel's 11. Reconcile the numbering against the panel when editing.)

The four records that matter at cutover

Records 1–4 and 6: apex A, apex AAAA, wildcard A, wildcard AAAA, and www. Change these and the site moves. Nothing else in the zone needs touching for the migration.

The wildcards are the item the old sheet omitted entirely. Because * carries both A and AAAA records, every hostname not listed above — chat, portal, panel, dashboard, newsletter, gateway, vault, git, registry, files, forum, email, docs, my, status — resolves only via the wildcard. They are not individual records and must not be created as such; they move when the wildcards move. A partial cutover that changes the apex but not * leaves every application on the old box.

Two DKIM selectors, for different senders

• cloudron._domainkey — the box's own mail signing (1024-bit). Used by the portal and by Listmonk, both of which relay through the Cloudron mail app.
• ede94f37-… — a UUID-named selector with a 2048-bit key. UUID selectors are what a service generates for itself, and this is almost certainly Scaleway Transactional Email's. Scaleway's own domain verification passed, which is the authority on whether it is right.

Name and value for row 11 are truncated in the panel screenshot. Read the full name in the panel (or from Scaleway's domain-verification page) before editing that row.

What the zone does NOT contain

No CNAME, no CAA, no SRV, no _acme-challenge entries. If any of those are ever needed, they are new records, not moves. (docs.inference.coop has no record of its own — it is served by the wildcard, which is why it answers with the Cloudron dashboard.)

Before the window

1. Lower the TTL on records 1–4 and 6 from 3600 to ~300. At 3600 a mistake takes an hour to correct; at 300 it takes five minutes. Do this a day ahead so the old TTL expires, then restore it afterwards.
2. Establish what server.inference.coop is used for. Resolved 2026-11-02: it was repointed to the new box with the rest (confirmed authoritatively on both NS). Its purpose is still unidentified, but it no longer references the old box — see the runbook's CUTOVER COMPLETE section.
3. Confirm the full name of record 11 (above).

Verification after the move

Query the authoritative nameservers, not a resolver, and query the specific name — a wildcard answer cannot be distinguished from a real record otherwise:

dig +short A    inference.coop        @ns1.yoursrs.com
dig +short AAAA inference.coop        @ns1.yoursrs.com
dig +short A    zz-random-check-9f2.inference.coop @ns1.yoursrs.com   # wildcard, must now be the NEW box
dig +short MX   inference.coop        @ns1.yoursrs.com

Then verify-restore.py. Its two known blind spots (the data group crashing on a missing PATH, and the mail check asserting a port-25 state it cannot observe from the agent host) are still unfixed — fix them before relying on a clean run.