← back to Claude Mail

docs/agentabrams-cloudflare-migration-package.md

68 lines

# agentabrams.com → Cloudflare migration — turnkey package
Prepared 2026-06-25 (DTD verdict C). Source: live authoritative GoDaddy zone (captured + dig-verified).
Cloudflare is NOT API-wired on this machine → this is a **dashboard** task. Claude's job here was prep + parity validation.

## Why this exists
- Standing rule: always use Cloudflare DNS. `agentabrams.com` is on GoDaddy NS (`ns17/18.domaincontrol.com`).
- GoDaddy API write is blocked for this domain → no automated DNS, and it blocked the DKIM fix.
- Migrating unblocks automated DNS forever AND honors the rule.

## Execution (Steve, in the Cloudflare dashboard)
1. **Add a Site** → `agentabrams.com`. Let Cloudflare auto-scan/import the existing records.
2. **Verify the import against the manifest below.** Re-add anything CF missed. Set email records to **DNS only (grey cloud)** — never proxy MX/TXT/DKIM/DMARC. Web `A` records may be proxied (orange) or left grey; grey = exact current behavior (safest for parity).
3. **Add the one missing DKIM record** (selector 3) if not already present — see manifest. (This is also the standalone DKIM fix; doing it here folds it into the migration.)
4. **Lower TTLs** at GoDaddy a few hours before cutover (optional, shrinks the window).
5. **Swap NS at the GoDaddy registrar** to the two Cloudflare nameservers CF assigns. ← the only irreversible step.
6. **Verify** (script below). **Rollback** = revert registrar NS to `ns17/ns18.domaincontrol.com`; the GoDaddy zone stays intact until you're satisfied.

## Record manifest (must all exist in Cloudflare before the NS swap)

### A — all → `45.61.58.125`
`@`, `4square`, `abramsreport`, `admin`, `animals`, `auth`, `builds`, `businessclaw`, `butlr`, `cncp`, `costarica`, `deadradio`, `designerline`, `dogpark`, `fantasea`, `forza`, `gmail`, `grant`, `hormuzy`, `ideas`, `lawyers`, `live`, `livefleet`, `livesiteaudit`, `marketing`, `notes`, `pitch.sdcc`, `sdcc`, `sdccanalysis`, `venturablvd`, `venturaclaw`, `videos`

### CNAME
| name | target |
|------|--------|
| `www` | `agentabrams.com` (was `@`) |
| `_domainconnect` | `_domainconnect.gd.domaincontrol.com` *(GoDaddy-specific; safe to drop after migration)* |
| `purelymail1._domainkey` | `key1.dkimroot.purelymail.com` |
| `purelymail2._domainkey` | `key2.dkimroot.purelymail.com` |
| **`purelymail3._domainkey`** | **`key3.dkimroot.purelymail.com`  ← ADD (the DKIM fix; missing today)** |
| `purelymail1._domainkey.venturaclaw` | `key1.dkimroot.purelymail.com` |
| `purelymail2._domainkey.venturaclaw` | `key2.dkimroot.purelymail.com` |
| `purelymail3._domainkey.venturaclaw` | `key3.dkimroot.purelymail.com` |

### MX (priority 10)
| name | target |
|------|--------|
| `@` | `mailserver.purelymail.com` |
| `venturaclaw` | `mailserver.purelymail.com` |

### TXT
| name | value |
|------|-------|
| `@` | `v=spf1 include:_spf.purelymail.com ~all` |
| `@` | `purelymail_ownership_proof=ae4c06a75dc4de7de2be7d965203e9b3a9ddbe9bce65aead8e04e0e0913e13ee738286dc040e15b99151f6a3f4cb227044d8acc22978f39fb5bfa81a7d436e77` |
| `_dmarc` | `v=DMARC1; p=none; rua=mailto:steve@designerwallcoverings.com` |
| `venturaclaw` | `v=spf1 include:_spf.purelymail.com -all` |
| `venturaclaw` | `purelymail_ownership_proof=ae4c06a75dc4de7de2be7d965203e9b3a9ddbe9bce65aead8e04e0e0913e13ee738286dc040e15b99151f6a3f4cb227044d8acc22978f39fb5bfa81a7d436e77` |
| `_dmarc.venturaclaw` | `v=DMARC1; p=none; rua=mailto:steve@designerwallcoverings.com` |

### NS — do NOT recreate; the swap replaces `ns17/ns18.domaincontrol.com` with Cloudflare's pair.

## Post-cutover verification
```sh
for h in @ cncp lawyers sdcc butlr venturablvd; do
  n=$( [ "$h" = "@" ] && echo agentabrams.com || echo "$h.agentabrams.com" )
  echo "$n -> $(dig +short A $n @1.1.1.1 | tr '\n' ' ')"
done
echo "MX:    $(dig +short MX agentabrams.com @1.1.1.1)"
echo "SPF:   $(dig +short TXT agentabrams.com @1.1.1.1 | grep spf)"
echo "DMARC: $(dig +short TXT _dmarc.agentabrams.com @1.1.1.1)"
for s in 1 2 3; do echo "DKIM$s: $(dig +short CNAME purelymail$s._domainkey.agentabrams.com @1.1.1.1)"; done
```
All A → `45.61.58.125`; MX → purelymail; SPF/DMARC present; **DKIM 1/2/3 all resolve** (3 is the new one).

## To make this fully automatable next time
Wire a Cloudflare API token into the stack via the `secrets` skill (zone-create + DNS-edit scope). Then `agentabrams.com` (and future domains) can be migrated/edited programmatically instead of by hand.