2026-05-21 11:14:42 -06:00
|
|
|
; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
|
|
|
|
|
; Source: zones/context.bet.zone
|
2026-05-12 01:51:09 -06:00
|
|
|
$ORIGIN context.bet.
|
|
|
|
|
$TTL 3600
|
2026-05-21 11:14:42 -06:00
|
|
|
@ 3600 IN SOA ns1.he.net. admin.context.bet. (
|
|
|
|
|
2026052102 ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
|
|
|
|
|
300 ; refresh (5 min) — slaves poll us this often;
|
|
|
|
|
; tightened from 3600 to nudge HE's internal
|
|
|
|
|
; puller→anycast replication
|
|
|
|
|
120 ; retry (2 min) — kept < refresh per RFC 1912
|
|
|
|
|
604800 ; expire (1 week)
|
|
|
|
|
60 ; minimum (1 min) — negative-cache TTL on public
|
|
|
|
|
; resolvers; shrinks the window when an old
|
|
|
|
|
; NXDOMAIN keeps showing after we add a name
|
|
|
|
|
)
|
2026-05-12 01:51:09 -06:00
|
|
|
|
2026-05-21 11:14:42 -06:00
|
|
|
@ 3600 IN NS ns1.he.net.
|
|
|
|
|
@ 3600 IN NS ns2.he.net.
|
|
|
|
|
@ 3600 IN NS ns3.he.net.
|
|
|
|
|
@ 3600 IN NS ns4.he.net.
|
|
|
|
|
@ 3600 IN NS ns5.he.net.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@ 300 IN A 74.91.22.234
|
|
|
|
|
* 300 IN CNAME context.bet.
|
|
|
|
|
@ 300 IN MX 10 context.bet.
|
2026-05-12 01:51:09 -06:00
|
|
|
_acme-challenge.studio 300 IN TXT "Li380TywS7mThEIWuivl7P2Zkt3xM5Ug_dYEa-oN238"
|
|
|
|
|
_acme-challenge.studio 300 IN TXT "KHzdoVgJnWS-pYx0MFaeqzMxkAKMIffHYBE-FgV_gz8"
|
|
|
|
|
_acme-challenge 300 IN TXT "YvpqyCHZnlMxlA5I7PJu4FXLXRlObIdvTmd07P_Hctg"
|
|
|
|
|
_acme-challenge 300 IN TXT "v69JehSdw3zzXbpMXt78_ehOwyK_lB95xazpar9QCUw"
|
|
|
|
|
_acme-challenge.studio 300 IN TXT "-jLi-_E2LQeDcK-90-AsaMSmjIwVuqSpG_Ec6Caqy0k"
|
|
|
|
|
_acme-challenge 300 IN TXT "8hQvvSl-TOe9-1zh-SX0MuqBdNLkcEA_-qreWrJfCCc"
|
|
|
|
|
_acme-challenge 300 IN TXT "oidj3oOo-olO9H9lGoM4Nz4b9Uu5StG7N9Rl9sr23jA"
|
|
|
|
|
_acme-challenge.studio 300 IN TXT "iDNJ2D5UE1OdScdVr_lP4uzZMxIqsdnM7a8aVqIT19k"
|
|
|
|
|
_acme-challenge.studio 300 IN TXT "ycghCSKyjTMG4bvykVnTvQcphzWN5eYg00dUfnqVSFc"
|
|
|
|
|
_acme-challenge 300 IN TXT "XyNd3vAko2O8Mkcyls7doan9uW5lG35SGPv-SmyxivQ"
|
|
|
|
|
_acme-challenge 300 IN TXT "bzSz7HZ4JgWEroq1WfsIvQRR1zgjQy12BRjUhYqGFBw"
|
|
|
|
|
_acme-challenge.studio 300 IN TXT "99qVcWYwN_XUWXC586zZppJi5cLPfQfivCeRhXXbRqw"
|
|
|
|
|
_acme-challenge 300 IN TXT "p1ZqtSwtskcGdDNXB5q2s8tvKD2vm7vptvQNGjmXY1M"
|
|
|
|
|
_acme-challenge 300 IN TXT "G2GOJARalsSvrMPBxNB8dHHK2hfSEvuZJ6BiH-n2uIs"
|
|
|
|
|
_acme-challenge.studio 300 IN TXT "Td4SJyBCFrlG0A7fkzg7NXgxyK1ZJ6dzD2tb4UwcmcU"
|
|
|
|
|
_acme-challenge.studio 300 IN TXT "nV2gUz5waLhkPJIyL_MC1wtPOjivETBxYQhVYehZIX0"
|
|
|
|
|
_acme-challenge 300 IN TXT "uKLKmUQtvlP5ma77toyn8rtmM4dHdqUQdQIW5pSHHUU"
|
|
|
|
|
_acme-challenge 300 IN TXT "8lJ4Ury26qHtSwLaABC9UB_ZdFja3ZmujmUg7-5Y4Bg"
|
|
|
|
|
_acme-challenge 300 IN TXT "FSMb7Ru6xgzIIUvlzSzzVnOsGQD2Dgxm_qhx6hyymnE"
|
|
|
|
|
_acme-challenge 300 IN TXT "yB9kMNkHqVDe5vMvkgN5SFxiXgDSlSyUgldfW971BXw"
|
|
|
|
|
_acme-challenge 300 IN TXT "dpheXmHW0vH_NW5t8Ie_OWXiJkZT0l2U2Yu9w5n5uZg"
|
zones: add explicit CNAME-to-apex for RFC 4592 empty-non-terminals
Wildcards in DNS only synthesize for names that don't already exist
in the zone tree. A `_acme-challenge.<sub>` TXT record makes <sub>
an "empty non-terminal" — exists in the tree (as a parent node) but
has no records of its own. Per RFC 4592 §2.2.3, wildcards skip these,
so RFC-compliant resolvers (HE, BIND) return NODATA for <sub> even
when the zone has `* CNAME @`.
Fix: for each <sub> that's an empty non-terminal in a zone with a
wildcard, add an explicit `<sub> CNAME @` so the resolution outcome
matches what the wildcard would have produced. Zero-knowledge — no
need to identify the specific service IP per name.
30 records added across 14 zones:
acrazy.org (langfuse.dootie)
context.bet (studio)
copper-springs.online (docs.butler.dev)
demostar.io (cw.cw, doom, meet)
home-inspector.store (api, dashboard, mailpit)
inspect.pics (admin)
log.doctor (app, docs)
malloys.us (cp, cp-sandbox, mary)
nielsen-inspections.com (calendar, cw, files, v2-calendar)
qubeseptic.com (api.dispatch, dispatch, leads, mail.dispatch,
rentcache.dispatch)
ryanmalloy.com (c4ai)
sidejob.pro (api)
upc.llc (catalog, minio.or, or, s3)
CoreDNS (lenient) was returning the wildcard CNAME for these names
anyway; HE (strict RFC-compliant) was returning empty. After this
change, both behave identically.
2026-05-18 18:34:51 -06:00
|
|
|
_acme-challenge 300 IN TXT "K6DYSkbn2Fk_P0fA1fxbIZszce4NzjTtgodaUNxDS1w"
|
2026-05-21 11:14:42 -06:00
|
|
|
studio 300 IN CNAME context.bet.
|