runbooks/dns-change-sheet.md

DNS change sheet — Cloudron migration (Hostinger → Infomaniak)

Prepared 2026-10-30 from a live zone inventory (zone_inventory.json, 41 records). Registrar: yoursrs.com (NS for domains.coop). Cloudron cannot manage these records; every change below is manual. Nothing here is time-sensitive except the TTL lowering.

Counts, so the switch is not underestimated

• 19 A records → 179.199.135.72
• 18 AAAA records → 2a02:4780:6e:83fd::1 (Hostinger's range)
• 1 MX, 1 SPF TXT, 1 DKIM TXT, 1 DMARC TXT
• No CAA records, so no certificate-authority restriction to update.
• The zone is wildcarded. A nonsense name (definitely-not-a-real-host-xyz. inference.coop) resolves to the same A/AAAA as inference.coop itself, so any name answers. Two consequences: (a) a name that resolves is not evidence that a record exists — docs.inference.coop was listed in this sheet on exactly that mistake, and does not exist; (b) DNS cannot verify the cutover per-name. Check the registrar's record list against this sheet rather than resolving hostnames. If the wildcard is a real edge record, it must be repointed at cutover too, or every name relying on it stays on the old box while the named records move.
• Configured TTL is 3600 s on every record. (Lower these a day early; the 1090–1204 s seen on some answers are cache countdowns, not zone values.)

Records to change at cutover

Name	Type	Current	Set to
chat-legacy.inference.coop	A	179.199.135.72	179.237.86.116
chat.inference.coop	A	179.199.135.72	179.237.86.116
cloud.inference.coop	A	179.199.135.72	179.237.86.116
dashboard.inference.coop	A	179.199.135.72	179.237.86.116
email.inference.coop	A	179.199.135.72	179.237.86.116
forum.inference.coop	A	179.199.135.72	179.237.86.116
gateway.inference.coop	A	179.199.135.72	179.237.86.116
git.inference.coop	A	179.199.135.72	179.237.86.116
inference.coop	A	179.199.135.72	179.237.86.116
matrix.inference.coop	A	179.199.135.72	179.237.86.116
my.inference.coop	A	179.199.135.72	179.237.86.116
newsletter.inference.coop	A	179.199.135.72	179.237.86.116
panel.inference.coop	A	179.199.135.72	179.237.86.116
portal.inference.coop	A	179.199.135.72	179.237.86.116
search.inference.coop	A	179.199.135.72	179.237.86.116
status.inference.coop	A	179.199.135.72	179.237.86.116
vault.inference.coop	A	179.199.135.72	179.237.86.116
www.inference.coop	A	179.199.135.72	179.237.86.116
chat-legacy.inference.coop	AAAA	2a02:4780:6e:83fd::1	2001:1600:18:206::89
chat.inference.coop	AAAA	2a02:4780:6e:83fd::1	2001:1600:18:206::89
cloud.inference.coop	AAAA	2a02:4780:6e:83fd::1	2001:1600:18:206::89
dashboard.inference.coop	AAAA	2a02:4780:6e:83fd::1	2001:1600:18:206::89
email.inference.coop	AAAA	2a02:4780:6e:83fd::1	2001:1600:18:206::89
forum.inference.coop	AAAA	2a02:4780:6e:83fd::1	2001:1600:18:206::89
gateway.inference.coop	AAAA	2a02:4780:6e:83fd::1	2001:1600:18:206::89
git.inference.coop	AAAA	2a02:4780:6e:83fd::1	2001:1600:18:206::89
inference.coop	AAAA	2a02:4780:6e:83fd::1	2001:1600:18:206::89
matrix.inference.coop	AAAA	2a02:4780:6e:83fd::1	2001:1600:18:206::89
my.inference.coop	AAAA	2a02:4780:6e:83fd::1	2001:1600:18:206::89
newsletter.inference.coop	AAAA	2a02:4780:6e:83fd::1	2001:1600:18:206::89
panel.inference.coop	AAAA	2a02:4780:6e:83fd::1	2001:1600:18:206::89
portal.inference.coop	AAAA	2a02:4780:6e:83fd::1	2001:1600:18:206::89
search.inference.coop	AAAA	2a02:4780:6e:83fd::1	2001:1600:18:206::89
status.inference.coop	AAAA	2a02:4780:6e:83fd::1	2001:1600:18:206::89
vault.inference.coop	AAAA	2a02:4780:6e:83fd::1	2001:1600:18:206::89

www has no app behind it in the Cloudron inventory — confirm whether it is an alias, a redirect, or stale before touching it.

Records that must NOT change, but must be re-verified after the restore

Name	Type	Value	Why
inference.coop	MX	10 my.inference.coop.	Follows the A record; no MX edit needed.
inference.coop	TXT (SPF)	v=spf1 a:my.inference.coop ~all	Hostname-based — survives the IP change.
cloudron._domainkey	TXT (DKIM)	v=DKIM1; t=s; p=MIGfMA0…	Must match the key inside the restored mail app's data. Mismatch + DMARC below = silently discarded mail.
_dmarc	TXT	v=DMARC1; p=reject; pct=100	Reject policy: misaligned mail is DISCARDED, not junked.

Sequence (see the main runbook §4)

1. A day early: set every A and AAAA TTL to 300 s.
2. At cutover: point A records at 179.237.86.116; repoint every AAAA record to 2001:1600:18:206::89 (the new box has IPv6, so this is a repoint, not a delete — but it must happen in the same pass: an IPv6-capable client or homeserver left on Hostinger's address reaches the old box even after the A switch).
3. Verify with the resolver set below, not one resolver.

for h in inference.coop my.inference.coop matrix.inference.coop gateway.inference.coop; do
  dig +short A $h @1.1.1.1; dig +short A $h @8.8.8.8; dig +short AAAA $h @1.1.1.1
done

The new box (given 2026-10-30)

• IPv4 179.237.86.116 · IPv6 2001:1600:18:206::89
• 4 CPU · 12 GB RAM · 250 GB disk · unlimited traffic
• 1 snapshot slot free — take a snapshot after a clean restore and before the DNS switch, so a bad restore is a revert rather than a rebuild.
• Location Plan-les-Ouates, Switzerland (same provider as the backup target, so the restore reads from inside Infomaniak's network).
• Ubuntu 26.04 LTS — confirm Cloudron 9.x supports it before installing.
• Reverse DNS is listed as "configure" for BOTH addresses. Set PTR → my.inference.coop on the IPv4 and the IPv6. A sending IP without matching PTR is the classic cause of fresh-IP mail landing in spam, and DMARC here is p=reject on our own domain.