[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F5SNRKFD2HA03X6JSVPTPS":3,"skill-same:01M6F5SNRKFD2HA03X6JSVPTPS":74},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":21,"commitSha":54,"skillDirectory":55,"forksCount":56,"repositoryHtmlUrl":57,"repositoryHomepageUrl":6,"ownerHtmlUrl":58,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":59,"install":60,"resources":73},"01M6F5SNRKFD2HA03X6JSVPTPS","dns-management",null,"Configure DNS zones and records. Manage Route53, Cloud DNS, and self-hosted DNS. Use when setting up DNS infrastructure.","boisenoise\u002Fskills-collections","boisenoise","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F193180?v=4","01M6CDBDQK6BDN55ZMA6B6PKBM","01M6CDBDVSJ3JPTBYN26FZ7TZK",12,"MIT","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-dns-management\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"dns","dns management","management","main","2026","when","relevant","route53","scripts","critical","os","platform","self","security","community","self-hosted","up","only","configure","access","devops-security","infrastructure","2026-11-10 10:12:30",false,"---\nname: dns-management\ndescription: Configure DNS zones and records. Manage Route53, Cloud DNS, and self-hosted\n  DNS. Use when setting up DNS infrastructure.\ncategory: devops\nrisk: critical\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires the relevant OS\u002Fplatform tooling and privileged access where\n  noted. Docs-only; helper scripts and templates not bundled.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n\n# DNS Management\n\nConfigure and manage DNS zones, records, and resolution for production infrastructure.\n\n## When to Use\n\n- Setting up domains for web applications, APIs, and email.\n- Migrating DNS providers or consolidating zones.\n- Configuring DNS for CDN, load balancers, and cloud services.\n- Troubleshooting resolution failures, propagation delays, or misconfigurations.\n- Implementing DNSSEC, SPF, DKIM, and DMARC for email security.\n\n## Prerequisites\n\n- Domain registered with a registrar (Namecheap, Route53, Google Domains, Cloudflare).\n- Access to DNS provider dashboard or API.\n- AWS CLI configured (for Route53 examples).\n- `dig` and `nslookup` available locally (included in most OS installs).\n\n## DNS Record Types Reference\n\n| Type  | Purpose | Example Value |\n|-------|---------|---------------|\n| A     | IPv4 address | `93.184.216.34` |\n| AAAA  | IPv6 address | `2606:2800:220:1:248:1893:25c8:1946` |\n| CNAME | Alias to another domain | `www.example.com -> example.com` |\n| MX    | Mail server with priority | `10 mail.example.com` |\n| TXT   | Arbitrary text (SPF, DKIM, verification) | `v=spf1 include:_spf.google.com ~all` |\n| NS    | Authoritative name servers | `ns1.example.com` |\n| SRV   | Service location (host, port, priority) | `10 5 5060 sip.example.com` |\n| CAA   | Certificate Authority Authorization | `0 issue \"letsencrypt.org\"` |\n| PTR   | Reverse DNS lookup | `34.216.184.93.in-addr.arpa` |\n\nConfirm provider account, public\u002Fprivate zone ID and authoritative delegation before writes; same domain names can exist in multiple zones. Export current records and define rollback, especially MX\u002FNS\u002FDS changes. Cloudflare lookup must check success and exactly one expected zone, handle pagination\u002Ferrors and include application\u002Fjson on JSON writes. Use protected token inputs rather than exposing credentials in process\u002Flog output. Querying +dnssec requests DNSSEC data; use a validating resolver AD result or a validator such as delv for actual chain verification. Provider Terraform resource names vary by major. Email records are provider-specific examples: verify legitimate senders\u002Falignment and reporting privacy before enforcement. Changing authoritative TTL does not shorten already cached TTLs or negative caches; DNS failover is not immediate.\n\n## AWS Route 53\n\n### Hosted Zone Management\n\n```bash\n# Create a hosted zone\naws route53 create-hosted-zone \\\n  --name example.com \\\n  --caller-reference \"$(date +%s)\"\n\n# List hosted zones\naws route53 list-hosted-zones\n\n# Get name servers for a zone (update at your registrar)\naws route53 get-hosted-zone --id Z1234567890ABC \\\n  --query 'DelegationSet.NameServers'\n```\n\n### Create and Manage Records\n\n```bash\n# Create an A record\naws route53 change-resource-record-sets \\\n  --hosted-zone-id Z1234567890ABC \\\n  --change-batch '{\n    \"Changes\": [{\n      \"Action\": \"CREATE\",\n      \"ResourceRecordSet\": {\n        \"Name\": \"app.example.com\",\n        \"Type\": \"A\",\n        \"TTL\": 300,\n        \"ResourceRecords\": [{\"Value\": \"93.184.216.34\"}]\n      }\n    }]\n  }'\n\n# Create a CNAME record\naws route53 change-resource-record-sets \\\n  --hosted-zone-id Z1234567890ABC \\\n  --change-batch '{\n    \"Changes\": [{\n      \"Action\": \"CREATE\",\n      \"ResourceRecordSet\": {\n        \"Name\": \"www.example.com\",\n        \"Type\": \"CNAME\",\n        \"TTL\": 300,\n        \"ResourceRecords\": [{\"Value\": \"example.com\"}]\n      }\n    }]\n  }'\n\n# Create an alias record (no TTL, Route53-specific)\naws route53 change-resource-record-sets \\\n  --hosted-zone-id Z1234567890ABC \\\n  --change-batch '{\n    \"Changes\": [{\n      \"Action\": \"CREATE\",\n      \"ResourceRecordSet\": {\n        \"Name\": \"example.com\",\n        \"Type\": \"A\",\n        \"AliasTarget\": {\n          \"HostedZoneId\": \"Z2FDTNDATAQYW2\",\n          \"DNSName\": \"d1234567890.cloudfront.net\",\n          \"EvaluateTargetHealth\": false\n        }\n      }\n    }]\n  }'\n\n# List records in a zone\naws route53 list-resource-record-sets --hosted-zone-id Z1234567890ABC\n\n# Delete a record (Action: DELETE with exact match)\naws route53 change-resource-record-sets \\\n  --hosted-zone-id Z1234567890ABC \\\n  --change-batch '{\n    \"Changes\": [{\n      \"Action\": \"DELETE\",\n      \"ResourceRecordSet\": {\n        \"Name\": \"old.example.com\",\n        \"Type\": \"A\",\n        \"TTL\": 300,\n        \"ResourceRecords\": [{\"Value\": \"1.2.3.4\"}]\n      }\n    }]\n  }'\n```\n\n### Route 53 Health Checks\n\n```bash\n# Create a health check\naws route53 create-health-check --caller-reference \"$(date +%s)\" \\\n  --health-check-config '{\n    \"IPAddress\": \"93.184.216.34\",\n    \"Port\": 443,\n    \"Type\": \"HTTPS\",\n    \"ResourcePath\": \"\u002Fhealth\",\n    \"RequestInterval\": 30,\n    \"FailureThreshold\": 3\n  }'\n```\n\n## Cloudflare DNS\n\n### Manage Records via API\n\n```bash\n# Get zone ID\nZONE_ID=$(curl -s \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fzones?name=example.com\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\" | jq -r '.result[0].id')\n\n# Create an A record (proxied through Cloudflare)\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fzones\u002F$ZONE_ID\u002Fdns_records\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"type\":\"A\",\"name\":\"app\",\"content\":\"93.184.216.34\",\"proxied\":true,\"ttl\":1}'\n\n# Create a CNAME record (DNS only, not proxied)\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fzones\u002F$ZONE_ID\u002Fdns_records\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\" \\\n  -d '{\"type\":\"CNAME\",\"name\":\"docs\",\"content\":\"docs.readthedocs.io\",\"proxied\":false,\"ttl\":3600}'\n\n# List all records\ncurl -s \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fzones\u002F$ZONE_ID\u002Fdns_records\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\" | jq '.result[] | {name, type, content, proxied}'\n\n# Delete a record\ncurl -X DELETE \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fzones\u002F$ZONE_ID\u002Fdns_records\u002F$RECORD_ID\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\"\n```\n\n## Terraform DNS Management\n\n### Route 53 with Terraform\n\n```hcl\n# dns.tf\nresource \"aws_route53_zone\" \"main\" {\n  name = \"example.com\"\n}\n\nresource \"aws_route53_record\" \"app\" {\n  zone_id = aws_route53_zone.main.zone_id\n  name    = \"app.example.com\"\n  type    = \"A\"\n  ttl     = 300\n  records = [\"93.184.216.34\"]\n}\n\nresource \"aws_route53_record\" \"www\" {\n  zone_id = aws_route53_zone.main.zone_id\n  name    = \"www.example.com\"\n  type    = \"CNAME\"\n  ttl     = 300\n  records = [\"example.com\"]\n}\n\n# Alias record for CloudFront\nresource \"aws_route53_record\" \"cdn\" {\n  zone_id = aws_route53_zone.main.zone_id\n  name    = \"example.com\"\n  type    = \"A\"\n\n  alias {\n    name                   = aws_cloudfront_distribution.main.domain_name\n    zone_id                = aws_cloudfront_distribution.main.hosted_zone_id\n    evaluate_target_health = false\n  }\n}\n\n# Email records\nresource \"aws_route53_record\" \"mx\" {\n  zone_id = aws_route53_zone.main.zone_id\n  name    = \"example.com\"\n  type    = \"MX\"\n  ttl     = 3600\n  records = [\n    \"1 aspmx.l.google.com\",\n    \"5 alt1.aspmx.l.google.com\",\n    \"5 alt2.aspmx.l.google.com\",\n  ]\n}\n\nresource \"aws_route53_record\" \"spf\" {\n  zone_id = aws_route53_zone.main.zone_id\n  name    = \"example.com\"\n  type    = \"TXT\"\n  ttl     = 3600\n  records = [\"v=spf1 include:_spf.google.com ~all\"]\n}\n\nresource \"aws_route53_record\" \"dmarc\" {\n  zone_id = aws_route53_zone.main.zone_id\n  name    = \"_dmarc.example.com\"\n  type    = \"TXT\"\n  ttl     = 3600\n  records = [\"v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100\"]\n}\n```\n\n### Cloudflare with Terraform\n\n```hcl\nresource \"cloudflare_record\" \"app\" {\n  zone_id = var.cloudflare_zone_id\n  name    = \"app\"\n  content = \"93.184.216.34\"\n  type    = \"A\"\n  proxied = true\n}\n\nresource \"cloudflare_record\" \"mail\" {\n  zone_id  = var.cloudflare_zone_id\n  name     = \"@\"\n  content  = \"aspmx.l.google.com\"\n  type     = \"MX\"\n  priority = 1\n}\n```\n\n## DNS Troubleshooting Commands\n\n### dig\n\n```bash\n# Query A record\ndig app.example.com A +short\n\n# Query from a specific DNS server\ndig @8.8.8.8 app.example.com A\n\n# Show full answer with TTL\ndig app.example.com A +noall +answer\n\n# Query MX records\ndig example.com MX +short\n\n# Trace the full resolution path\ndig app.example.com +trace\n\n# Request DNSSEC records (DO flag; this alone does not validate signatures)\ndig example.com +dnssec +short\n\n# Query TXT records (SPF, DKIM)\ndig example.com TXT +short\ndig default._domainkey.example.com TXT +short\n```\n\n### nslookup\n\n```bash\n# Basic lookup\nnslookup app.example.com\n\n# Specify DNS server\nnslookup app.example.com 8.8.8.8\n\n# Query specific record type\nnslookup -type=MX example.com\nnslookup -type=TXT example.com\n```\n\n### Check DNS Propagation\n\n```bash\n# Query multiple public resolvers\nfor dns in 8.8.8.8 1.1.1.1 9.9.9.9 208.67.222.222; do\n  echo \"=== $dns ===\"\n  dig @$dns app.example.com A +short\ndone\n```\n\n## Email Security Records\n\n```bash\n# SPF — authorize sending servers\n# TXT record on example.com\n\"v=spf1 include:_spf.google.com include:sendgrid.net -all\"\n\n# DKIM — email signing verification\n# TXT record on google._domainkey.example.com\n# (value provided by your email provider)\n\n# DMARC — policy for failed SPF\u002FDKIM\n# TXT record on _dmarc.example.com\n\"v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com; pct=100\"\n```\n\n## TTL Strategies\n\n| Scenario | Recommended TTL | Rationale |\n|----------|----------------|-----------|\n| Stable production records | 3600-86400 (1h-24h) | Reduce DNS queries, faster resolution |\n| Pre-migration warmup | 60-300 (1-5 min) | Lower TTL days before migration |\n| During migration\u002Ffailover | 60 | Fast propagation of changes |\n| Post-migration cooldown | Gradually increase to 3600+ | Return to normal after confirming stability |\n| Load-balanced records | 60-300 | Allow health-check-driven failover |\n\n## Troubleshooting\n\n| Symptom | Cause | Fix |\n|---------|-------|-----|\n| DNS changes not visible | TTL not expired on recursive resolvers | Wait for old TTL to expire; lower TTL before next change |\n| `SERVFAIL` response | DNSSEC validation failure or broken delegation | Check NS records at registrar; verify DNSSEC signatures |\n| `NXDOMAIN` for valid record | Wrong hosted zone or missing record | Verify record exists with `dig @\u003Cauthoritative-ns> domain` |\n| CNAME at zone apex returns error | CNAME not allowed at zone apex per RFC | Use a supported Route53 alias target or Cloudflare CNAME flattening; proxying an A record is not a CNAME replacement |\n| Email going to spam | Missing or broken SPF\u002FDKIM\u002FDMARC | Verify TXT records with `dig example.com TXT`; test at mail-tester.com |\n| Slow resolution | Recursive resolver far from authoritative NS | Use Anycast DNS providers (Cloudflare, Route53) |\n| Inconsistent results across resolvers | Partial propagation or cache poisoning | Query authoritative NS directly; check for conflicting records |\n\n## Related Skills\n\n- cdn-setup (`cdn-setup`) - CDN CNAME and alias record configuration\n- load-balancing (`load-balancing`) - DNS-based load balancing and health checks\n- cloudflare-zero-trust (`cloudflare-zero-trust`) - Tunnel DNS routing\n- reverse-proxy (`reverse-proxy`) - Connecting domains to backend services\n\n## Limitations\n\n- Infrastructure commands can disrupt services: confirm target host\u002Fscope and have backups\u002Fsnapshots before mutating state.\n- Docs-only import: upstream scripts and templates not bundled.\n\n","# DNS Management\n\nConfigure and manage DNS zones, records, and resolution for production infrastructure.\n\n## When to Use\n\n- Setting up domains for web applications, APIs, and email.\n- Migrating DNS providers or consolidating zones.\n- Configuring DNS for CDN, load balancers, and cloud services.\n- Troubleshooting resolution failures, propagation delays, or misconfigurations.\n- Implementing DNSSEC, SPF, DKIM, and DMARC for email security.\n\n## Prerequisites\n\n- Domain registered with a registrar (Namecheap, Route53, Google Domains, Cloudflare).\n- Access to DNS provider dashboard or API.\n- AWS CLI configured (for Route53 examples).\n- `dig` and `nslookup` available locally (included in most OS installs).\n\n## DNS Record Types Reference\n\n| Type  | Purpose | Example Value |\n|-------|---------|---------------|\n| A     | IPv4 address | `93.184.216.34` |\n| AAAA  | IPv6 address | `2606:2800:220:1:248:1893:25c8:1946` |\n| CNAME | Alias to another domain | `www.example.com -> example.com` |\n| MX    | Mail server with priority | `10 mail.example.com` |\n| TXT   | Arbitrary text (SPF, DKIM, verification) | `v=spf1 include:_spf.google.com ~all` |\n| NS    | Authoritative name servers | `ns1.example.com` |\n| SRV   | Service location (host, port, priority) | `10 5 5060 sip.example.com` |\n| CAA   | Certificate Authority Authorization | `0 issue \"letsencrypt.org\"` |\n| PTR   | Reverse DNS lookup | `34.216.184.93.in-addr.arpa` |\n\nConfirm provider account, public\u002Fprivate zone ID and authoritative delegation before writes; same domain names can exist in multiple zones. Export current records and define rollback, especially MX\u002FNS\u002FDS changes. Cloudflare lookup must check success and exactly one expected zone, handle pagination\u002Ferrors and include application\u002Fjson on JSON writes. Use protected token inputs rather than exposing credentials in process\u002Flog output. Querying +dnssec requests DNSSEC data; use a validating resolver AD result or a validator such as delv for actual chain verification. Provider Terraform resource names vary by major. Email records are provider-specific examples: verify legitimate senders\u002Falignment and reporting privacy before enforcement. Changing authoritative TTL does not shorten already cached TTLs or negative caches; DNS failover is not immediate.\n\n## AWS Route 53\n\n### Hosted Zone Management\n\n```bash\n# Create a hosted zone\naws route53 create-hosted-zone \\\n  --name example.com \\\n  --caller-reference \"$(date +%s)\"\n\n# List hosted zones\naws route53 list-hosted-zones\n\n# Get name servers for a zone (update at your registrar)\naws route53 get-hosted-zone --id Z1234567890ABC \\\n  --query 'DelegationSet.NameServers'\n```\n\n### Create and Manage Records\n\n```bash\n# Create an A record\naws route53 change-resource-record-sets \\\n  --hosted-zone-id Z1234567890ABC \\\n  --change-batch '{\n    \"Changes\": [{\n      \"Action\": \"CREATE\",\n      \"ResourceRecordSet\": {\n        \"Name\": \"app.example.com\",\n        \"Type\": \"A\",\n        \"TTL\": 300,\n        \"ResourceRecords\": [{\"Value\": \"93.184.216.34\"}]\n      }\n    }]\n  }'\n\n# Create a CNAME record\naws route53 change-resource-record-sets \\\n  --hosted-zone-id Z1234567890ABC \\\n  --change-batch '{\n    \"Changes\": [{\n      \"Action\": \"CREATE\",\n      \"ResourceRecordSet\": {\n        \"Name\": \"www.example.com\",\n        \"Type\": \"CNAME\",\n        \"TTL\": 300,\n        \"ResourceRecords\": [{\"Value\": \"example.com\"}]\n      }\n    }]\n  }'\n\n# Create an alias record (no TTL, Route53-specific)\naws route53 change-resource-record-sets \\\n  --hosted-zone-id Z1234567890ABC \\\n  --change-batch '{\n    \"Changes\": [{\n      \"Action\": \"CREATE\",\n      \"ResourceRecordSet\": {\n        \"Name\": \"example.com\",\n        \"Type\": \"A\",\n        \"AliasTarget\": {\n          \"HostedZoneId\": \"Z2FDTNDATAQYW2\",\n          \"DNSName\": \"d1234567890.cloudfront.net\",\n          \"EvaluateTargetHealth\": false\n        }\n      }\n    }]\n  }'\n\n# List records in a zone\naws route53 list-resource-record-sets --hosted-zone-id Z1234567890ABC\n\n# Delete a record (Action: DELETE with exact match)\naws route53 change-resource-record-sets \\\n  --hosted-zone-id Z1234567890ABC \\\n  --change-batch '{\n    \"Changes\": [{\n      \"Action\": \"DELETE\",\n      \"ResourceRecordSet\": {\n        \"Name\": \"old.example.com\",\n        \"Type\": \"A\",\n        \"TTL\": 300,\n        \"ResourceRecords\": [{\"Value\": \"1.2.3.4\"}]\n      }\n    }]\n  }'\n```\n\n### Route 53 Health Checks\n\n```bash\n# Create a health check\naws route53 create-health-check --caller-reference \"$(date +%s)\" \\\n  --health-check-config '{\n    \"IPAddress\": \"93.184.216.34\",\n    \"Port\": 443,\n    \"Type\": \"HTTPS\",\n    \"ResourcePath\": \"\u002Fhealth\",\n    \"RequestInterval\": 30,\n    \"FailureThreshold\": 3\n  }'\n```\n\n## Cloudflare DNS\n\n### Manage Records via API\n\n```bash\n# Get zone ID\nZONE_ID=$(curl -s \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fzones?name=example.com\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\" | jq -r '.result[0].id')\n\n# Create an A record (proxied through Cloudflare)\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fzones\u002F$ZONE_ID\u002Fdns_records\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"type\":\"A\",\"name\":\"app\",\"content\":\"93.184.216.34\",\"proxied\":true,\"ttl\":1}'\n\n# Create a CNAME record (DNS only, not proxied)\ncurl -X POST \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fzones\u002F$ZONE_ID\u002Fdns_records\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\" \\\n  -d '{\"type\":\"CNAME\",\"name\":\"docs\",\"content\":\"docs.readthedocs.io\",\"proxied\":false,\"ttl\":3600}'\n\n# List all records\ncurl -s \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fzones\u002F$ZONE_ID\u002Fdns_records\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\" | jq '.result[] | {name, type, content, proxied}'\n\n# Delete a record\ncurl -X DELETE \"https:\u002F\u002Fapi.cloudflare.com\u002Fclient\u002Fv4\u002Fzones\u002F$ZONE_ID\u002Fdns_records\u002F$RECORD_ID\" \\\n  -H \"Authorization: Bearer $CF_API_TOKEN\"\n```\n\n## Terraform DNS Management\n\n### Route 53 with Terraform\n\n```hcl\n# dns.tf\nresource \"aws_route53_zone\" \"main\" {\n  name = \"example.com\"\n}\n\nresource \"aws_route53_record\" \"app\" {\n  zone_id = aws_route53_zone.main.zone_id\n  name    = \"app.example.com\"\n  type    = \"A\"\n  ttl     = 300\n  records = [\"93.184.216.34\"]\n}\n\nresource \"aws_route53_record\" \"www\" {\n  zone_id = aws_route53_zone.main.zone_id\n  name    = \"www.example.com\"\n  type    = \"CNAME\"\n  ttl     = 300\n  records = [\"example.com\"]\n}\n\n# Alias record for CloudFront\nresource \"aws_route53_record\" \"cdn\" {\n  zone_id = aws_route53_zone.main.zone_id\n  name    = \"example.com\"\n  type    = \"A\"\n\n  alias {\n    name                   = aws_cloudfront_distribution.main.domain_name\n    zone_id                = aws_cloudfront_distribution.main.hosted_zone_id\n    evaluate_target_health = false\n  }\n}\n\n# Email records\nresource \"aws_route53_record\" \"mx\" {\n  zone_id = aws_route53_zone.main.zone_id\n  name    = \"example.com\"\n  type    = \"MX\"\n  ttl     = 3600\n  records = [\n    \"1 aspmx.l.google.com\",\n    \"5 alt1.aspmx.l.google.com\",\n    \"5 alt2.aspmx.l.google.com\",\n  ]\n}\n\nresource \"aws_route53_record\" \"spf\" {\n  zone_id = aws_route53_zone.main.zone_id\n  name    = \"example.com\"\n  type    = \"TXT\"\n  ttl     = 3600\n  records = [\"v=spf1 include:_spf.google.com ~all\"]\n}\n\nresource \"aws_route53_record\" \"dmarc\" {\n  zone_id = aws_route53_zone.main.zone_id\n  name    = \"_dmarc.example.com\"\n  type    = \"TXT\"\n  ttl     = 3600\n  records = [\"v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100\"]\n}\n```\n\n### Cloudflare with Terraform\n\n```hcl\nresource \"cloudflare_record\" \"app\" {\n  zone_id = var.cloudflare_zone_id\n  name    = \"app\"\n  content = \"93.184.216.34\"\n  type    = \"A\"\n  proxied = true\n}\n\nresource \"cloudflare_record\" \"mail\" {\n  zone_id  = var.cloudflare_zone_id\n  name     = \"@\"\n  content  = \"aspmx.l.google.com\"\n  type     = \"MX\"\n  priority = 1\n}\n```\n\n## DNS Troubleshooting Commands\n\n### dig\n\n```bash\n# Query A record\ndig app.example.com A +short\n\n# Query from a specific DNS server\ndig @8.8.8.8 app.example.com A\n\n# Show full answer with TTL\ndig app.example.com A +noall +answer\n\n# Query MX records\ndig example.com MX +short\n\n# Trace the full resolution path\ndig app.example.com +trace\n\n# Request DNSSEC records (DO flag; this alone does not validate signatures)\ndig example.com +dnssec +short\n\n# Query TXT records (SPF, DKIM)\ndig example.com TXT +short\ndig default._domainkey.example.com TXT +short\n```\n\n### nslookup\n\n```bash\n# Basic lookup\nnslookup app.example.com\n\n# Specify DNS server\nnslookup app.example.com 8.8.8.8\n\n# Query specific record type\nnslookup -type=MX example.com\nnslookup -type=TXT example.com\n```\n\n### Check DNS Propagation\n\n```bash\n# Query multiple public resolvers\nfor dns in 8.8.8.8 1.1.1.1 9.9.9.9 208.67.222.222; do\n  echo \"=== $dns ===\"\n  dig @$dns app.example.com A +short\ndone\n```\n\n## Email Security Records\n\n```bash\n# SPF — authorize sending servers\n# TXT record on example.com\n\"v=spf1 include:_spf.google.com include:sendgrid.net -all\"\n\n# DKIM — email signing verification\n# TXT record on google._domainkey.example.com\n# (value provided by your email provider)\n\n# DMARC — policy for failed SPF\u002FDKIM\n# TXT record on _dmarc.example.com\n\"v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com; pct=100\"\n```\n\n## TTL Strategies\n\n| Scenario | Recommended TTL | Rationale |\n|----------|----------------|-----------|\n| Stable production records | 3600-86400 (1h-24h) | Reduce DNS queries, faster resolution |\n| Pre-migration warmup | 60-300 (1-5 min) | Lower TTL days before migration |\n| During migration\u002Ffailover | 60 | Fast propagation of changes |\n| Post-migration cooldown | Gradually increase to 3600+ | Return to normal after confirming stability |\n| Load-balanced records | 60-300 | Allow health-check-driven failover |\n\n## Troubleshooting\n\n| Symptom | Cause | Fix |\n|---------|-------|-----|\n| DNS changes not visible | TTL not expired on recursive resolvers | Wait for old TTL to expire; lower TTL before next change |\n| `SERVFAIL` response | DNSSEC validation failure or broken delegation | Check NS records at registrar; verify DNSSEC signatures |\n| `NXDOMAIN` for valid record | Wrong hosted zone or missing record | Verify record exists with `dig @\u003Cauthoritative-ns> domain` |\n| CNAME at zone apex returns error | CNAME not allowed at zone apex per RFC | Use a supported Route53 alias target or Cloudflare CNAME flattening; proxying an A record is not a CNAME replacement |\n| Email going to spam | Missing or broken SPF\u002FDKIM\u002FDMARC | Verify TXT records with `dig example.com TXT`; test at mail-tester.com |\n| Slow resolution | Recursive resolver far from authoritative NS | Use Anycast DNS providers (Cloudflare, Route53) |\n| Inconsistent results across resolvers | Partial propagation or cache poisoning | Query authoritative NS directly; check for conflicting records |\n\n## Related Skills\n\n- cdn-setup (`cdn-setup`) - CDN CNAME and alias record configuration\n- load-balancing (`load-balancing`) - DNS-based load balancing and health checks\n- cloudflare-zero-trust (`cloudflare-zero-trust`) - Tunnel DNS routing\n- reverse-proxy (`reverse-proxy`) - Connecting domains to backend services\n\n## Limitations\n\n- Infrastructure commands can disrupt services: confirm target host\u002Fscope and have backups\u002Fsnapshots before mutating state.\n- Docs-only import: upstream scripts and templates not bundled.\n\n",{"name":5,"risk":27,"source":45,"license":14,"category":46,"metadata":47,"date_added":50,"description":7,"source_repo":51,"source_type":32,"compatibility":52,"license_source":53},"https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills","devops",{"author":48,"version":49},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Requires the relevant OS\u002Fplatform tooling and privileged access where noted. Docs-only; helper scripts and templates not bundled.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","7bf2279c8a65758319526a721d5c4b75683aec9c","skills\u002Fantigravity-dns-management",3,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections","https:\u002F\u002Fgithub.com\u002Fboisenoise","2026-11-10 14:20:15",{"source":8,"skillName":5,"commands":61,"prompt":71,"zipAvailable":72},[62,65,68],{"tool":63,"command":64},"npx","npx skills add boisenoise\u002Fskills-collections --skill dns-management",{"tool":66,"command":67},"bunx","bunx skills add boisenoise\u002Fskills-collections --skill dns-management",{"tool":69,"command":70},"pnpm","pnpm dlx skills add boisenoise\u002Fskills-collections --skill dns-management","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-dns-management\u002FSKILL.md",true,[],[75,99,127,153,172,195],{"skillNo":76,"name":77,"nameZh":6,"description":78,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":79,"licenseFileUrl":80,"sourceHtmlUrl":81,"categories":82,"keywords":83,"publishedAt":40},"01M6WNH92BHVFXHGPDZCPJ0AG0","web-access","Use Treg for public web or platform data only when existing search, browser and connected tools cannot cover the task, with explicit cost and data boundaries.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FSKILL.md",[],[84,37,85,86,87,88,89,90,91,92,93,35,94,95,29,27,96,97,98,23,22],"web","web access","official","development","browser","search","data","Tools","read","fetch","youtube","free tools","free","cover","normal",{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":79,"licenseFileUrl":103,"sourceHtmlUrl":104,"categories":105,"keywords":111,"publishedAt":40},"01M6WNF9XAYAB2CZDDJBAKNM93","treg","Use the Treg CLI or MCP catalog to discover, price and call authorized external tools with team-scoped credentials and a user-approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FSKILL.md",[106],{"categoryNo":107,"categoryName":108,"taxonomyType":109,"taxonomyTypeDesc":110},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[101,112,113,114,86,87,115,91,116,117,118,119,120,121,122,27,123,124,125,126,22],"MCP","cli","github","license","Budget","credentials","team","catalog","use","call","discover","external tools","with","scoped","blob",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":79,"licenseFileUrl":131,"sourceHtmlUrl":132,"categories":133,"keywords":139,"publishedAt":40},"01M6WN93MEAZ4E41DYAHJRPHQT","recruit","Turn a job description into an evidence-linked candidate shortlist through Treg, with job-related ranking and optional authorized business contact enrichment.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FSKILL.md",[134],{"categoryNo":135,"categoryName":136,"taxonomyType":137,"taxonomyTypeDesc":138},"01JBSEEDCAT000000000000038","人力资源","PROFESSION","适用职业",[129,114,86,115,140,141,142,143,144,145,27,146,147,148,124,149,150,151,152,126,101,22],"https","email","enrichment","business","evidence","phone","ranking","post","job description","for","person","candidate","reason",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":79,"licenseFileUrl":157,"sourceHtmlUrl":158,"categories":159,"keywords":160,"publishedAt":40},"01M6WN8R5RXSMHM9B4D9FAFX42","rea-growth","Analyze a company’s public growth and content through Treg, distinguish observations from hypotheses, and produce an evidence-linked playbook within an approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FSKILL.md",[],[161,162,163,114,86,115,164,165,140,166,116,167,168,169,144,27,170,171,126,101,22],"growth","rea","rea growth","produce","content","playbook","marketing","analyze","public","observations","company",{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":79,"licenseFileUrl":176,"sourceHtmlUrl":177,"categories":178,"keywords":179,"publishedAt":40},"01M6WN2EVE3RQRGWAKBT4S7YT2","make-ugc","Create original AI UGC-style product videos through Treg: research hooks, approve a licensed presenter and voice, generate clips, add captions and report costs.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FSKILL.md",[],[180,181,114,182,86,183,115,184,185,186,187,188,27,189,190,191,192,193,194,126],"make","make ugc","research","create","Video","Captions","ads","short","hooks","head","style","niche","trending","talking-head","approve",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":79,"licenseFileUrl":199,"sourceHtmlUrl":200,"categories":201,"keywords":202,"publishedAt":40},"01M6WN10ARAA63Y8K1YNGXJ2RM","lead-signals","Find and qualify public buying signals through Treg, rank fitting business accounts and optionally enrich authorized business contact information.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FSKILL.md",[],[203,204,205,114,86,115,206,207,143,208,209,27,210,211,212,213,214,215,216,126],"signals","lead","lead signals","how","find","ready","as","how to","qualify","people","information","enrich","changes","funding"]