Architecture: DNS Management
## Deployment: DNS Management
DNS records for all pal-e platform domains, managed via OpenTofu with the GoDaddy provider.
### Diagram
```mermaid
graph TB
subgraph GoDaddy["GoDaddy DNS"]
A_Records[A Records]
TXT_SPF[SPF TXT Records]
TXT_DKIM[DKIM TXT Records]
TXT_DMARC[DMARC TXT Records]
end
subgraph OpenTofu["OpenTofu IaC"]
DNS_TF[terraform/dns.tf]
Provider[ldraney/godaddy provider v0.1.0]
end
subgraph Hetzner["Hetzner"]
PTR[PTR/rDNS Record]
VPS[Edge VPS 178.156.129.142]
end
DNS_TF --> Provider
Provider --> A_Records
Provider --> TXT_SPF
Provider --> TXT_DKIM
Provider --> TXT_DMARC
A_Records -->|resolves to| VPS
PTR -->|reverse lookup| VPS
```
### Components
| Component | Purpose | Notes |
|-----------|---------|-------|
| GoDaddy DNS | Authoritative nameserver for all domains | Registrar + nameserver hosting |
| OpenTofu | IaC for DNS record management | `terraform/dns.tf` with `godaddy_domain_record` resources |
| A Records | Point domains to edge VPS | All resolve to 178.156.129.142 |
| SPF Record | Authorize sending IP | `v=spf1 ip4:178.156.129.142 -all` |
| DKIM Record | Cryptographic signing verification | `mail._domainkey` → public key from Stalwart |
| DMARC Record | Policy for failed auth | `v=DMARC1; p=reject; rua=mailto:...` |
| PTR/rDNS | Reverse DNS for deliverability | Managed via Hetzner console, not Terraform |
### Key Decisions
- **GoDaddy as registrar + DNS**: All domains already registered here; consolidates management
- **OpenTofu for DNS IaC**: Reproducible, version-controlled record management
- **Separate PTR management**: PTR records belong to IP owner (Hetzner), not domain registrar
- **Strict SPF (-all)**: Hard-fail policy for maximum deliverability reputation
- **DMARC reject policy**: Prevents domain spoofing; monitors via `rua` aggregate reports
### Related
- `arch-edge-vps` — the VPS that A records point to
- `arch-stalwart` — generates DKIM keys referenced in DNS
- Project: `stalwart-email`
## Domains
| Domain | Purpose | A Record Target |
|--------|---------|-----------------|
| landscaping-assistant.app | Landscaping app (public) | 178.156.129.142 |
| westsidekingsandqueens.com | Basketball league app | 178.156.129.142 |
| palinks.dev | Link shortener | 178.156.129.142 |
## IaC Location
- **File**: `terraform/dns.tf` in `pal-e-platform`
- **Provider**: `ldraney/godaddy` v0.1.0
- **Pattern**: `godaddy_domain_record` resources per record type
## Key Constraints
- GoDaddy API has rate limits — batch changes where possible
- PTR records are managed by Hetzner (IP owner), not GoDaddy
- DKIM key is generated by Stalwart — must be extracted after install