[object Object]

← back to Dw Yolo Loop

CF DNS drift snapshotter: read-only zone export + diff vs last commit

e122d4f856e81528f8e5092d6b6e19e623eb6ec8 · 2026-06-16 00:35:10 -0700 · Steve Abrams

Captures all 35 CF zones (136 records) to a deterministic git-tracked JSON,
diffs vs HEAD, tripwires on MX/SPF/DKIM/DMARC changes on protected domains
(DW/wallco/sdcc/agentabrams/PR). CF access GET-only, no DNS writes. Baseline
committed so the next run detects drift.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Files touched

Diff

commit e122d4f856e81528f8e5092d6b6e19e623eb6ec8
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue Jun 16 00:35:10 2026 -0700

    CF DNS drift snapshotter: read-only zone export + diff vs last commit
    
    Captures all 35 CF zones (136 records) to a deterministic git-tracked JSON,
    diffs vs HEAD, tripwires on MX/SPF/DKIM/DMARC changes on protected domains
    (DW/wallco/sdcc/agentabrams/PR). CF access GET-only, no DNS writes. Baseline
    committed so the next run detects drift.
    
    Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 scripts/cf-dns-snapshot/cf-dns-snapshot.js         |  138 +++
 .../cf-dns-snapshot/snapshots/cf-zones-latest.json | 1164 ++++++++++++++++++++
 2 files changed, 1302 insertions(+)

diff --git a/scripts/cf-dns-snapshot/cf-dns-snapshot.js b/scripts/cf-dns-snapshot/cf-dns-snapshot.js
new file mode 100644
index 0000000..e61b2bb
--- /dev/null
+++ b/scripts/cf-dns-snapshot/cf-dns-snapshot.js
@@ -0,0 +1,138 @@
+#!/usr/bin/env node
+/**
+ * Cloudflare DNS/zone drift snapshotter — READ-ONLY export + diff vs last commit.
+ *
+ * 200+ (today 35) CF zones are hand-edited with zero change history; a fat-fingered
+ * proxy toggle or clobbered MX/SPF/DKIM silently breaks a site or inbound mail for
+ * days. This serializes every zone's DNS records to a deterministic git-tracked JSON,
+ * diffs against the previously committed snapshot (git HEAD), and raises a TRIPWIRE on
+ * any change to mail-auth records (MX / SPF / DKIM / DMARC) on protected domains.
+ *
+ * CF access is GET-only (zones + dns_records). The only writes are the local snapshot
+ * JSON + report. NO DNS writes. Cost: $0.
+ *
+ *   node cf-dns-snapshot.js          # snapshot + diff vs HEAD + report
+ * After running, `git add` the snapshot so the NEXT run can diff against it.
+ */
+const fs = require('fs');
+const path = require('path');
+const { execSync } = require('child_process');
+
+const TOKEN = (fs.readFileSync(path.join(process.env.HOME, 'Projects/secrets-manager/.env'), 'utf8')
+  .match(/^CLOUDFLARE_API_TOKEN=(.+)$/m) || [])[1]?.trim();
+if (!TOKEN) { console.error('no CLOUDFLARE_API_TOKEN'); process.exit(1); }
+
+const DIR = __dirname;
+const SNAP_REL = 'scripts/cf-dns-snapshot/snapshots/cf-zones-latest.json';
+const SNAP_ABS = path.join(process.env.HOME, 'Projects/designerwallcoverings', SNAP_REL);
+const REPORT = path.join(process.env.HOME, '.claude/yolo-queue', `cf-dns-drift-${new Date().toISOString().slice(0,10)}.md`);
+
+// Protected domains: a mail-auth change here is the catastrophic case.
+const PROTECTED = [/designerwallcoverings/i, /wallco/i, /sdcc/i, /agentabrams/i, /philipperomano/i];
+const MAIL_TYPES = new Set(['MX', 'TXT']); // SPF/DKIM/DMARC live in TXT
+const isMailAuth = (r) => r.type === 'MX' || (r.type === 'TXT' && /v=spf1|v=DKIM1|v=DMARC1|_dmarc|_domainkey/i.test(r.name + ' ' + r.content));
+
+const sleep = (ms) => new Promise(r => setTimeout(r, ms));
+async function cf(pathq) {
+  for (let a = 0; a < 5; a++) {
+    try {
+      const res = await fetch(`https://api.cloudflare.com/client/v4${pathq}`, { headers: { Authorization: `Bearer ${TOKEN}` } });
+      if (res.status === 429) { await sleep(2000 * (a + 1)); continue; }
+      const j = await res.json();
+      if (!j.success) throw new Error(JSON.stringify(j.errors).slice(0, 160));
+      return j;
+    } catch (e) { if (a === 4) throw e; await sleep(1500 * (a + 1)); }
+  }
+}
+
+async function allZones() {
+  const out = []; let page = 1;
+  while (true) {
+    const j = await cf(`/zones?per_page=50&page=${page}`);
+    out.push(...j.result);
+    if (page >= (j.result_info.total_pages || 1)) break;
+    page++;
+  }
+  return out;
+}
+async function zoneRecords(id) {
+  const out = []; let page = 1;
+  while (true) {
+    const j = await cf(`/zones/${id}/dns_records?per_page=100&page=${page}`);
+    out.push(...j.result);
+    if (page >= (j.result_info.total_pages || 1)) break;
+    page++;
+  }
+  // deterministic shape, sorted
+  return out.map(r => ({ type: r.type, name: r.name, content: r.content, proxied: !!r.proxied, ttl: r.ttl, priority: r.priority ?? null }))
+    .sort((a, b) => (a.type + a.name + a.content).localeCompare(b.type + b.name + b.content));
+}
+
+function loadPrior() {
+  try { return JSON.parse(execSync(`git show HEAD:${SNAP_REL} 2>/dev/null`, { cwd: path.join(process.env.HOME, 'Projects/designerwallcoverings'), encoding: 'utf8' })); }
+  catch (_) { return null; }
+}
+
+function diff(prior, current) {
+  // returns { added:[], removed:[], zone-level } keyed by zone
+  const changes = [];
+  const allZoneNames = new Set([...Object.keys(prior?.zones || {}), ...Object.keys(current.zones)]);
+  for (const z of allZoneNames) {
+    const p = (prior?.zones?.[z] || []).map(r => JSON.stringify(r));
+    const c = (current.zones[z] || []).map(r => JSON.stringify(r));
+    const pset = new Set(p), cset = new Set(c);
+    const added = c.filter(x => !pset.has(x)).map(JSON.parse);
+    const removed = p.filter(x => !cset.has(x)).map(JSON.parse);
+    if (added.length || removed.length) changes.push({ zone: z, added, removed });
+  }
+  return changes;
+}
+
+(async () => {
+  const zones = await allZones();
+  const snap = { generated_at: new Date().toISOString(), zone_count: zones.length, zones: {} };
+  for (const z of zones) { snap.zones[z.name] = await zoneRecords(z.id); }
+
+  const prior = loadPrior();
+  const changes = prior ? diff(prior, snap) : null;
+
+  // tripwire: mail-auth changes on protected domains
+  const tripwires = [];
+  if (changes) for (const ch of changes) {
+    if (!PROTECTED.some(rx => rx.test(ch.zone))) continue;
+    const mailChanged = [...ch.added, ...ch.removed].filter(isMailAuth);
+    if (mailChanged.length) tripwires.push({ zone: ch.zone, records: mailChanged });
+  }
+
+  fs.mkdirSync(path.dirname(SNAP_ABS), { recursive: true });
+  fs.writeFileSync(SNAP_ABS, JSON.stringify(snap, null, 2));
+
+  const totalRecords = Object.values(snap.zones).reduce((n, a) => n + a.length, 0);
+  let md = `# Cloudflare DNS drift — ${new Date().toISOString().slice(0,16)}\n\n`;
+  md += `Zones: **${zones.length}** · DNS records: **${totalRecords}** · Snapshot: \`${SNAP_REL}\`\n\n`;
+  if (!prior) {
+    md += `**First run — baseline captured.** No prior committed snapshot to diff against. ` +
+          `Commit \`${SNAP_REL}\` so the next run detects drift.\n`;
+    console.log(`[cf-dns-snapshot] BASELINE — ${zones.length} zones, ${totalRecords} records. Commit the snapshot to enable drift detection.`);
+  } else {
+    md += `## Drift vs last commit\n`;
+    if (!changes.length) { md += `🟢 No changes since last snapshot.\n`; console.log(`[cf-dns-snapshot] PASS — no drift across ${zones.length} zones.`); }
+    else {
+      md += `🟠 **${changes.length} zone(s) changed.**\n\n`;
+      for (const ch of changes) {
+        md += `### ${ch.zone}\n`;
+        for (const r of ch.removed) md += `- \`- ${r.type} ${r.name} → ${r.content}${r.proxied?' (proxied)':''}\`\n`;
+        for (const r of ch.added)   md += `- \`+ ${r.type} ${r.name} → ${r.content}${r.proxied?' (proxied)':''}\`\n`;
+      }
+      console.log(`[cf-dns-snapshot] DRIFT — ${changes.length} zone(s) changed.`);
+    }
+    if (tripwires.length) {
+      md += `\n## 🔴 TRIPWIRE — mail-auth change on a PROTECTED domain\n`;
+      for (const t of tripwires) { md += `### ${t.zone}\n`; for (const r of t.records) md += `- ${r.type} ${r.name} → ${r.content}\n`; }
+      console.log(`[cf-dns-snapshot] 🔴 ${tripwires.length} PROTECTED mail-auth tripwire(s)!`);
+    }
+  }
+  fs.mkdirSync(path.dirname(REPORT), { recursive: true });
+  fs.writeFileSync(REPORT, md);
+  console.log(`Report: ${REPORT}\nSnapshot: ${SNAP_ABS}`);
+})().catch(e => { console.error('FATAL', e.message); process.exit(1); });
diff --git a/scripts/cf-dns-snapshot/snapshots/cf-zones-latest.json b/scripts/cf-dns-snapshot/snapshots/cf-zones-latest.json
new file mode 100644
index 0000000..d695bee
--- /dev/null
+++ b/scripts/cf-dns-snapshot/snapshots/cf-zones-latest.json
@@ -0,0 +1,1164 @@
+{
+  "generated_at": "2026-06-16T07:34:49.334Z",
+  "zone_count": 35,
+  "zones": {
+    "818butler.com": [
+      {
+        "type": "CNAME",
+        "name": "818butler.com",
+        "content": "818butler.pages.dev",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "abramsatlas.com": [
+      {
+        "type": "CNAME",
+        "name": "abramsatlas.com",
+        "content": "abramsatlas.pages.dev",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "abramscivic.com": [
+      {
+        "type": "CNAME",
+        "name": "abramscivic.com",
+        "content": "abramscivic.pages.dev",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "abramsdirectory.com": [
+      {
+        "type": "CNAME",
+        "name": "abramsdirectory.com",
+        "content": "abramsdirectory.pages.dev",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "abramsguide.com": [
+      {
+        "type": "CNAME",
+        "name": "abramsguide.com",
+        "content": "abramsguide.pages.dev",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "abramsindex.com": [
+      {
+        "type": "CNAME",
+        "name": "abramsindex.com",
+        "content": "abramsindex.pages.dev",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "abramsindustries.com": [
+      {
+        "type": "CNAME",
+        "name": "abramsindustries.com",
+        "content": "abramsindustries.pages.dev",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "abramsintel.com": [
+      {
+        "type": "CNAME",
+        "name": "abramsintel.com",
+        "content": "abramsintel.pages.dev",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "abramsintelligence.com": [
+      {
+        "type": "CNAME",
+        "name": "abramsintelligence.com",
+        "content": "abramsintelligence.pages.dev",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "abramslive.com": [
+      {
+        "type": "CNAME",
+        "name": "abramslive.com",
+        "content": "abramslive.pages.dev",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "abramslocal.com": [
+      {
+        "type": "CNAME",
+        "name": "abramslocal.com",
+        "content": "abramslocal.pages.dev",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "abramsmaps.com": [
+      {
+        "type": "CNAME",
+        "name": "abramsmaps.com",
+        "content": "abramsmaps.pages.dev",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "abramsmarkets.com": [
+      {
+        "type": "CNAME",
+        "name": "abramsmarkets.com",
+        "content": "abramsmarkets.pages.dev",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "abramsos.com": [
+      {
+        "type": "CNAME",
+        "name": "abramsos.com",
+        "content": "abramsos.pages.dev",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "abramsprotection.com": [
+      {
+        "type": "CNAME",
+        "name": "abramsprotection.com",
+        "content": "abramsprotection.pages.dev",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "abramsspace.com": [
+      {
+        "type": "CNAME",
+        "name": "abramsspace.com",
+        "content": "abramsspace.pages.dev",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "abramsterminal.com": [
+      {
+        "type": "CNAME",
+        "name": "abramsterminal.com",
+        "content": "abramsterminal.pages.dev",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "abramsvc.com": [
+      {
+        "type": "CNAME",
+        "name": "abramsvc.com",
+        "content": "abramsvc.pages.dev",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "beverlyhillsbutler.com": [
+      {
+        "type": "CNAME",
+        "name": "beverlyhillsbutler.com",
+        "content": "beverlyhillsbutler.pages.dev",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "bhbutler.com": [
+      {
+        "type": "AAAA",
+        "name": "bhbutler.com",
+        "content": "100::",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "boomercalc.com": [
+      {
+        "type": "A",
+        "name": "boomercalc.com",
+        "content": "76.76.21.21",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "A",
+        "name": "www.boomercalc.com",
+        "content": "76.76.21.21",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "_domainconnect.boomercalc.com",
+        "content": "_domainconnect.gd.domaincontrol.com",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "boulevardbutler.com": [
+      {
+        "type": "AAAA",
+        "name": "boulevardbutler.com",
+        "content": "100::",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "bubbe.ai": [
+      {
+        "type": "A",
+        "name": "bubbe.ai",
+        "content": "45.61.58.125",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "_domainconnect.bubbe.ai",
+        "content": "_domainconnect.gd.domaincontrol.com",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "www.bubbe.ai",
+        "content": "bubbe.ai",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "_dmarc.bubbe.ai",
+        "content": "\"v=DMARC1; p=quarantine; adkim=r; aspf=r; rua=mailto:dmarc_rua@onsecureserver.net;\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "cypresawards.com": [
+      {
+        "type": "A",
+        "name": "cypresawards.com",
+        "content": "45.61.58.125",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "A",
+        "name": "www.cypresawards.com",
+        "content": "45.61.58.125",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "designerwallcoverings.com": [
+      {
+        "type": "A",
+        "name": "artmura.designerwallcoverings.com",
+        "content": "45.61.58.125",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "A",
+        "name": "chat.designerwallcoverings.com",
+        "content": "45.61.58.125",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "A",
+        "name": "coleandson.designerwallcoverings.com",
+        "content": "45.61.58.125",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "A",
+        "name": "designerwallcoverings.com",
+        "content": "23.227.38.65",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "A",
+        "name": "pairs.designerwallcoverings.com",
+        "content": "45.61.58.125",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "A",
+        "name": "schumacher.designerwallcoverings.com",
+        "content": "45.61.58.125",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "A",
+        "name": "thibaut.designerwallcoverings.com",
+        "content": "45.61.58.125",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "_domainconnect.designerwallcoverings.com",
+        "content": "_domainconnect.gd.domaincontrol.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "www.designerwallcoverings.com",
+        "content": "shops.myshopify.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "MX",
+        "name": "designerwallcoverings.com",
+        "content": "alt1.aspmx.l.google.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": 5
+      },
+      {
+        "type": "MX",
+        "name": "designerwallcoverings.com",
+        "content": "alt2.aspmx.l.google.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": 5
+      },
+      {
+        "type": "MX",
+        "name": "designerwallcoverings.com",
+        "content": "alt3.aspmx.l.google.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": 10
+      },
+      {
+        "type": "MX",
+        "name": "designerwallcoverings.com",
+        "content": "alt4.aspmx.l.google.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": 10
+      },
+      {
+        "type": "MX",
+        "name": "designerwallcoverings.com",
+        "content": "aspmx.l.google.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": 1
+      },
+      {
+        "type": "NS",
+        "name": "designerwallcoverings.com",
+        "content": "ns71.domaincontrol.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "NS",
+        "name": "designerwallcoverings.com",
+        "content": "ns72.domaincontrol.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "SRV",
+        "name": "_sip._tls.designerwallcoverings.com",
+        "content": "1 443 sipdir.online.lync.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": 100
+      },
+      {
+        "type": "TXT",
+        "name": "_dmarc.designerwallcoverings.com",
+        "content": "\"v=DMARC1; p=none;\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "designerwallcoverings.com",
+        "content": "\"facebook-domain-verification=4muloo0qc7c8suvucsamfcu3w8u8t2\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "designerwallcoverings.com",
+        "content": "\"google-site-verification=AMZWmuLEuvfbe0QG3_yAGj6_Td6zUtXdSywQSwZw5gs\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "designerwallcoverings.com",
+        "content": "\"google-site-verification=BboCLZ6Cpos0QwILRseYO4vfjrOedg7hPAw3xcWDsoY\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "designerwallcoverings.com",
+        "content": "\"google-site-verification=D_H8-eYzvY_EqNp-izGuts3h9att1_OkSIen6k87rhg\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "designerwallcoverings.com",
+        "content": "\"google-site-verification=XVuEU02mHGalwxvxrLWzIkpP60F8U3EV5PnTDwwe1xs\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "designerwallcoverings.com",
+        "content": "\"NETORGFT14675893.onmicrosoft.com\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "designerwallcoverings.com",
+        "content": "\"v=spf1 include:_spf.google.com include:dc-aa8e722993._spfm.designerwallcoverings.com ~all\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "google._domainkey.designerwallcoverings.com",
+        "content": "\"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQE...\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "ffepurchasing.com": [
+      {
+        "type": "A",
+        "name": "ffepurchasing.com",
+        "content": "45.61.58.125",
+        "proxied": false,
+        "ttl": 300,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "_domainconnect.ffepurchasing.com",
+        "content": "_domainconnect.gd.domaincontrol.com",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "autodiscover.ffepurchasing.com",
+        "content": "autodiscover.outlook.com",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "email.ffepurchasing.com",
+        "content": "email.secureserver.net",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "ftp.ffepurchasing.com",
+        "content": "ffepurchasing.com",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "lyncdiscover.ffepurchasing.com",
+        "content": "webdir.online.lync.com",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "msoid.ffepurchasing.com",
+        "content": "clientconfig.microsoftonline-p.net",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "purelymail1._domainkey.ffepurchasing.com",
+        "content": "key1.dkimroot.purelymail.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "purelymail2._domainkey.ffepurchasing.com",
+        "content": "key2.dkimroot.purelymail.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "purelymail3._domainkey.ffepurchasing.com",
+        "content": "key3.dkimroot.purelymail.com",
+        "proxied": false,
+        "ttl": 3600,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "sip.ffepurchasing.com",
+        "content": "sipdir.online.lync.com",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "www.ffepurchasing.com",
+        "content": "ffepurchasing.com",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "MX",
+        "name": "ffepurchasing.com",
+        "content": "mailserver.purelymail.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": 10
+      },
+      {
+        "type": "SRV",
+        "name": "_sip._tls.ffepurchasing.com",
+        "content": "1 443 sipdir.online.lync.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": 100
+      },
+      {
+        "type": "SRV",
+        "name": "_sipfederationtls._tcp.ffepurchasing.com",
+        "content": "1 5061 sipfed.online.lync.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": 100
+      },
+      {
+        "type": "TXT",
+        "name": "_dmarc.ffepurchasing.com",
+        "content": "\"v=DMARC1; p=none; rua=mailto:steve@designerwallcoverings.com\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "ffepurchasing.com",
+        "content": "\"google-site-verification=kTlckwzO2sJdR5YIXz4tMo_X4mF64nFqBuHQJQiHGZw\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "ffepurchasing.com",
+        "content": "\"NETORGFT14675893.onmicrosoft.com\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "ffepurchasing.com",
+        "content": "\"purelymail_ownership_proof=ae4c06a75dc4de7de2be7d965203e9b3a9ddbe9bce65aead8e04e0e0913e13ee738286dc040e15b99151f6a3f4cb227044d8acc22978f39fb5bfa81a7d436e77\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "ffepurchasing.com",
+        "content": "\"v=spf1 include:_spf.purelymail.com ~all\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "ffepurchasing.com",
+        "content": "\"v=spf1 include:secureserver.net -all\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "flockedwallpaper.com": [
+      {
+        "type": "A",
+        "name": "flockedwallpaper.com",
+        "content": "45.61.58.125",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "A",
+        "name": "www.flockedwallpaper.com",
+        "content": "45.61.58.125",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "glassbeadedwallpaper.com": [
+      {
+        "type": "A",
+        "name": "glassbeadedwallpaper.com",
+        "content": "45.61.58.125",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "A",
+        "name": "www.glassbeadedwallpaper.com",
+        "content": "45.61.58.125",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "goodquestion.ai": [
+      {
+        "type": "A",
+        "name": "goodquestion.ai",
+        "content": "45.61.58.125",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "_domainconnect.goodquestion.ai",
+        "content": "_domainconnect.gd.domaincontrol.com",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "www.goodquestion.ai",
+        "content": "goodquestion.ai",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "grassclothwallcoverings.com": [
+      {
+        "type": "A",
+        "name": "grassclothwallcoverings.com",
+        "content": "45.61.58.125",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "A",
+        "name": "www.grassclothwallcoverings.com",
+        "content": "45.61.58.125",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "_domainconnect.grassclothwallcoverings.com",
+        "content": "_domainconnect.gd.domaincontrol.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "grassclothwallcoverings.com",
+        "content": "\"v=spf1 include:secureserver.net -all\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "grassclothwallpaper.com": [
+      {
+        "type": "A",
+        "name": "auth.grassclothwallpaper.com",
+        "content": "45.61.58.125",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "A",
+        "name": "bertha.grassclothwallpaper.com",
+        "content": "45.61.58.125",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "A",
+        "name": "grassclothwallpaper.com",
+        "content": "45.61.58.125",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "A",
+        "name": "www.grassclothwallpaper.com",
+        "content": "45.61.58.125",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "_domainconnect.grassclothwallpaper.com",
+        "content": "_domainconnect.gd.domaincontrol.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "grassclothwallpaper.com",
+        "content": "\"google-site-verification=wXbc0GvEvLMh8oweBEt3Mm-EXSASdSh2paTwQPgpvKU\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "grassclothwallpaper.com",
+        "content": "\"v=spf1 include:secureserver.net -all\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "hospitalitywallcoverings.com": [
+      {
+        "type": "A",
+        "name": "hospitalitywallcoverings.com",
+        "content": "45.61.58.125",
+        "proxied": false,
+        "ttl": 300,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "_domainconnect.hospitalitywallcoverings.com",
+        "content": "_domainconnect.gd.domaincontrol.com",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "autodiscover.hospitalitywallcoverings.com",
+        "content": "autodiscover.outlook.com",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "email.hospitalitywallcoverings.com",
+        "content": "email.secureserver.net",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "lyncdiscover.hospitalitywallcoverings.com",
+        "content": "webdir.online.lync.com",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "msoid.hospitalitywallcoverings.com",
+        "content": "clientconfig.microsoftonline-p.net",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "purelymail1._domainkey.hospitalitywallcoverings.com",
+        "content": "key1.dkimroot.purelymail.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "purelymail2._domainkey.hospitalitywallcoverings.com",
+        "content": "key2.dkimroot.purelymail.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "purelymail3._domainkey.hospitalitywallcoverings.com",
+        "content": "key3.dkimroot.purelymail.com",
+        "proxied": false,
+        "ttl": 3600,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "sip.hospitalitywallcoverings.com",
+        "content": "sipdir.online.lync.com",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "www.hospitalitywallcoverings.com",
+        "content": "hospitalitywallcoverings.com",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "MX",
+        "name": "hospitalitywallcoverings.com",
+        "content": "mailserver.purelymail.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": 10
+      },
+      {
+        "type": "SRV",
+        "name": "_sip._tls.hospitalitywallcoverings.com",
+        "content": "1 443 sipdir.online.lync.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": 100
+      },
+      {
+        "type": "SRV",
+        "name": "_sipfederationtls._tcp.hospitalitywallcoverings.com",
+        "content": "1 5061 sipfed.online.lync.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": 100
+      },
+      {
+        "type": "TXT",
+        "name": "_dmarc.hospitalitywallcoverings.com",
+        "content": "\"v=DMARC1; p=none; rua=mailto:steve@designerwallcoverings.com\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "hospitalitywallcoverings.com",
+        "content": "\"google-site-verification=vLuzsUt0lcc3rVcayrA44PCaAi2viK0XO8_IJT9h1Hc\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "hospitalitywallcoverings.com",
+        "content": "\"NETORGFT14677407.onmicrosoft.com\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "hospitalitywallcoverings.com",
+        "content": "\"purelymail_ownership_proof=ae4c06a75dc4de7de2be7d965203e9b3a9ddbe9bce65aead8e04e0e0913e13ee738286dc040e15b99151f6a3f4cb227044d8acc22978f39fb5bfa81a7d436e77\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "hospitalitywallcoverings.com",
+        "content": "\"v=spf1 include:_spf.purelymail.com include:_spf.google.com ~all\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "novasuede.com": [
+      {
+        "type": "A",
+        "name": "novasuede.com",
+        "content": "45.61.58.125",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "A",
+        "name": "www.novasuede.com",
+        "content": "45.61.58.125",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "_domainconnect.novasuede.com",
+        "content": "_domainconnect.gd.domaincontrol.com",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "MX",
+        "name": "novasuede.com",
+        "content": "mailstore1.secureserver.net",
+        "proxied": false,
+        "ttl": 1,
+        "priority": 10
+      },
+      {
+        "type": "MX",
+        "name": "novasuede.com",
+        "content": "smtp.secureserver.net",
+        "proxied": false,
+        "ttl": 1,
+        "priority": 10
+      },
+      {
+        "type": "NS",
+        "name": "novasuede.com",
+        "content": "ns65.domaincontrol.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "NS",
+        "name": "novasuede.com",
+        "content": "ns66.domaincontrol.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "_dmarc.novasuede.com",
+        "content": "\"v=DMARC1; p=quarantine; adkim=r; aspf=r; rua=mailto:dmarc_rua@onsecureserver.net;\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "novasuede.com",
+        "content": "\"v=spf1 include:secureserver.net -all\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "philipperomano.com": [
+      {
+        "type": "A",
+        "name": "philipperomano.com",
+        "content": "45.61.58.125",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "A",
+        "name": "www.philipperomano.com",
+        "content": "45.61.58.125",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      }
+    ],
+    "wallpapercanada.com": [
+      {
+        "type": "A",
+        "name": "wallpapercanada.com",
+        "content": "45.61.58.125",
+        "proxied": false,
+        "ttl": 300,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "_domainconnect.wallpapercanada.com",
+        "content": "_domainconnect.gd.domaincontrol.com",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "purelymail1._domainkey.wallpapercanada.com",
+        "content": "key1.dkimroot.purelymail.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "purelymail2._domainkey.wallpapercanada.com",
+        "content": "key2.dkimroot.purelymail.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "purelymail3._domainkey.wallpapercanada.com",
+        "content": "key3.dkimroot.purelymail.com",
+        "proxied": false,
+        "ttl": 3600,
+        "priority": null
+      },
+      {
+        "type": "CNAME",
+        "name": "www.wallpapercanada.com",
+        "content": "wallpapercanada.com",
+        "proxied": true,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "MX",
+        "name": "wallpapercanada.com",
+        "content": "mailserver.purelymail.com",
+        "proxied": false,
+        "ttl": 1,
+        "priority": 10
+      },
+      {
+        "type": "TXT",
+        "name": "_dmarc.wallpapercanada.com",
+        "content": "\"v=DMARC1; p=none; rua=mailto:steve@designerwallcoverings.com\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "wallpapercanada.com",
+        "content": "\"google-site-verification=tcrndDwTxyyJbrzT615bRZr9rzw6vxr45dLsZf6V3ZM\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "wallpapercanada.com",
+        "content": "\"purelymail_ownership_proof=ae4c06a75dc4de7de2be7d965203e9b3a9ddbe9bce65aead8e04e0e0913e13ee738286dc040e15b99151f6a3f4cb227044d8acc22978f39fb5bfa81a7d436e77\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      },
+      {
+        "type": "TXT",
+        "name": "wallpapercanada.com",
+        "content": "\"v=spf1 include:_spf.purelymail.com ~all\"",
+        "proxied": false,
+        "ttl": 1,
+        "priority": null
+      }
+    ]
+  }
+}
\ No newline at end of file

← 5159ca6 docs: verify resume-roll-adds REMAIN-counter edge-set concer  ·  back to Dw Yolo Loop  ·  April mass-archive restore staging plan (report-only, tiered 65f918b →