docs: agentabrams.com Cloudflare migration package (DTD verdict C, validated record manifest + parity check)

92f132044af438894e882740ec971911d9a6e48b · 2026-06-25 09:18:50 -0700 · Steve
Files touched

A docs/agentabrams-cloudflare-migration-package.md
Diff

commit 92f132044af438894e882740ec971911d9a6e48b
Author: Steve <steve@designerwallcoverings.com>
Date:   Thu Jun 25 09:18:50 2026 -0700

    docs: agentabrams.com Cloudflare migration package (DTD verdict C, validated record manifest + parity check)
---
 docs/agentabrams-cloudflare-migration-package.md | 67 ++++++++++++++++++++++++
 1 file changed, 67 insertions(+)

diff --git a/docs/agentabrams-cloudflare-migration-package.md b/docs/agentabrams-cloudflare-migration-package.md
new file mode 100644
index 0000000..4620b42
--- /dev/null
+++ b/docs/agentabrams-cloudflare-migration-package.md
@@ -0,0 +1,67 @@
+# agentabrams.com → Cloudflare migration — turnkey package
+Prepared 2026-06-25 (DTD verdict C). Source: live authoritative GoDaddy zone (captured + dig-verified).
+Cloudflare is NOT API-wired on this machine → this is a **dashboard** task. Claude's job here was prep + parity validation.
+
+## Why this exists
+- Standing rule: always use Cloudflare DNS. `agentabrams.com` is on GoDaddy NS (`ns17/18.domaincontrol.com`).
+- GoDaddy API write is blocked for this domain → no automated DNS, and it blocked the DKIM fix.
+- Migrating unblocks automated DNS forever AND honors the rule.
+
+## Execution (Steve, in the Cloudflare dashboard)
+1. **Add a Site** → `agentabrams.com`. Let Cloudflare auto-scan/import the existing records.
+2. **Verify the import against the manifest below.** Re-add anything CF missed. Set email records to **DNS only (grey cloud)** — never proxy MX/TXT/DKIM/DMARC. Web `A` records may be proxied (orange) or left grey; grey = exact current behavior (safest for parity).
+3. **Add the one missing DKIM record** (selector 3) if not already present — see manifest. (This is also the standalone DKIM fix; doing it here folds it into the migration.)
+4. **Lower TTLs** at GoDaddy a few hours before cutover (optional, shrinks the window).
+5. **Swap NS at the GoDaddy registrar** to the two Cloudflare nameservers CF assigns. ← the only irreversible step.
+6. **Verify** (script below). **Rollback** = revert registrar NS to `ns17/ns18.domaincontrol.com`; the GoDaddy zone stays intact until you're satisfied.
+
+## Record manifest (must all exist in Cloudflare before the NS swap)
+
+### A — all → `45.61.58.125`
+`@`, `4square`, `abramsreport`, `admin`, `animals`, `auth`, `builds`, `businessclaw`, `butlr`, `cncp`, `costarica`, `deadradio`, `designerline`, `dogpark`, `fantasea`, `forza`, `gmail`, `grant`, `hormuzy`, `ideas`, `lawyers`, `live`, `livefleet`, `livesiteaudit`, `marketing`, `notes`, `pitch.sdcc`, `sdcc`, `sdccanalysis`, `venturablvd`, `venturaclaw`, `videos`
+
+### CNAME
+| name | target |
+|------|--------|
+| `www` | `agentabrams.com` (was `@`) |
+| `_domainconnect` | `_domainconnect.gd.domaincontrol.com` *(GoDaddy-specific; safe to drop after migration)* |
+| `purelymail1._domainkey` | `key1.dkimroot.purelymail.com` |
+| `purelymail2._domainkey` | `key2.dkimroot.purelymail.com` |
+| **`purelymail3._domainkey`** | **`key3.dkimroot.purelymail.com`  ← ADD (the DKIM fix; missing today)** |
+| `purelymail1._domainkey.venturaclaw` | `key1.dkimroot.purelymail.com` |
+| `purelymail2._domainkey.venturaclaw` | `key2.dkimroot.purelymail.com` |
+| `purelymail3._domainkey.venturaclaw` | `key3.dkimroot.purelymail.com` |
+
+### MX (priority 10)
+| name | target |
+|------|--------|
+| `@` | `mailserver.purelymail.com` |
+| `venturaclaw` | `mailserver.purelymail.com` |
+
+### TXT
+| name | value |
+|------|-------|
+| `@` | `v=spf1 include:_spf.purelymail.com ~all` |
+| `@` | `purelymail_ownership_proof=ae4c06a75dc4de7de2be7d965203e9b3a9ddbe9bce65aead8e04e0e0913e13ee738286dc040e15b99151f6a3f4cb227044d8acc22978f39fb5bfa81a7d436e77` |
+| `_dmarc` | `v=DMARC1; p=none; rua=mailto:steve@designerwallcoverings.com` |
+| `venturaclaw` | `v=spf1 include:_spf.purelymail.com -all` |
+| `venturaclaw` | `purelymail_ownership_proof=ae4c06a75dc4de7de2be7d965203e9b3a9ddbe9bce65aead8e04e0e0913e13ee738286dc040e15b99151f6a3f4cb227044d8acc22978f39fb5bfa81a7d436e77` |
+| `_dmarc.venturaclaw` | `v=DMARC1; p=none; rua=mailto:steve@designerwallcoverings.com` |
+
+### NS — do NOT recreate; the swap replaces `ns17/ns18.domaincontrol.com` with Cloudflare's pair.
+
+## Post-cutover verification
+```sh
+for h in @ cncp lawyers sdcc butlr venturablvd; do
+  n=$( [ "$h" = "@" ] && echo agentabrams.com || echo "$h.agentabrams.com" )
+  echo "$n -> $(dig +short A $n @1.1.1.1 | tr '\n' ' ')"
+done
+echo "MX:    $(dig +short MX agentabrams.com @1.1.1.1)"
+echo "SPF:   $(dig +short TXT agentabrams.com @1.1.1.1 | grep spf)"
+echo "DMARC: $(dig +short TXT _dmarc.agentabrams.com @1.1.1.1)"
+for s in 1 2 3; do echo "DKIM$s: $(dig +short CNAME purelymail$s._domainkey.agentabrams.com @1.1.1.1)"; done
+```
+All A → `45.61.58.125`; MX → purelymail; SPF/DMARC present; **DKIM 1/2/3 all resolve** (3 is the new one).
+
+## To make this fully automatable next time
+Wire a Cloudflare API token into the stack via the `secrets` skill (zone-create + DNS-edit scope). Then `agentabrams.com` (and future domains) can be migrated/edited programmatically instead of by hand.
← 2c4c86b claude-mail: email channel for Claude at claude@agentabrams. · back to Claude Mail · mailer: archive every reply to IMAP Sent (best-effort) + rea 2afc049 →