@	1H	IN	SOA	ns1 hostmaster (
			2024011501	; serial
			12H		; refresh
			2H		; retry
			1W		; expire
			1H		; ncache
)

; Name servers
@	1D	NS	ns1
@	1D	NS	ns2

;; Records
ns1	1D	A	38.46.223.204
		AAAA	2602:294:0:b23::111 ; cloud17
ns2	1D	A	51.75.170.66
		AAAA	2001:41d0:801:2000::4089 ; OVH (GB)

$TTL 5M ; Default TTL for records

; CAA (issue: letsencrypt.org, iodef: mailto:caapolicy@wikitide.org)
@		TYPE257 \# 22 000569737375656C657473656E63727970742E6F7267
@		TYPE257 \# 36 0005696F6465666D61696C746F3A636161706F6C6963794077696B69746964652E6F7267

; Mail exchanges
@		MX	10	smtp.google.com.

; Mail policies
@		TXT	"v=spf1 include:_spf.google.com ~all"

; Mail autodiscovery
_imaps._tcp		IN SRV	0 0 993	imap.gmail.com.
_submission._tcp	IN SRV	0 0 587	smtp.gmail.com.

;; DKIM - Policy: Mail may be signed. Not required.
mail._domainkey		TXT	"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6G9cvC788kh1IUhXsrTUufHEEI4M4h1rDYDMUyBW4EL94Ls250F5wCOTR1HdcizHZy/ZetR8iVUz3vzGsMuGvuM2oL8L2vqGHMjorMuAEL46jaehC66psbBGlswtZFTG0ErWEAc4J8Mo9fLOvePUBn2cYDjHfm7xaqPP2lI2qbljzBVRG19IIQyOqvHZUsMvttWz98GK64ND3oKr2kfQyJFzNNMZG+Ynu8dZxr9iOTvZA4SQKW+ckOAglYe3lQr5IstIjJQt9gDH/lhNisn8Ew6/85lQCME0+hw0yaJGVc857f2w5erNl8wrTFsAkdmm3tdBaB8B4w+3CVVWp6v9zwIDAQAB"

;; DMARC - Policy: Reject - unauthorized mail will not send, remote SMTPs will just drop the mail.
_dmarc			TXT	"v=DMARC1; p=reject; pct=100; fo=1"

; BIMI - Used for verified emails
default._bimi		TXT	"v=BIMI1;l=https://static.wikitide.net/commonswiki/e/ea/WikiTide_BIMI.svg;a="

; Cloud Servers
; TODO: Remove once FQDNs have been updated to use wtnet
cloud15			A	38.46.218.154
			AAAA	2602:294:0:c8::100
cloud16			A	38.46.218.226
			AAAA	2602:294:0:b13::100
cloud17			A	38.46.218.228
			AAAA	2602:294:0:b23::100
cloud18			A	38.46.218.156
			AAAA	2602:294:0:b12::100
cloud19			A	38.46.218.157
			AAAA	2602:294:0:b33::100
cloud20			A	38.46.218.155
			AAAA	2602:294:0:b39::100

; Server Aliases
; Define these aliases only when:
; - External (public) access is necessary (bastions, cache proxies, mattermost)
; - Internal HTTPS access is required

;; Bastions
bast161			A	38.46.223.203
			AAAA	2602:294:0:b13::101
bast181			A	38.46.223.202
			AAAA	2602:294:0:b12::102

;; Cache Proxies
cp161			A	38.46.223.205
			AAAA	2602:294:0:b13::110
cp171			A	38.46.223.206
			AAAA	2602:294:0:b23::112
cp191			AAAA	2602:294:0:b33::102
cp201			AAAA	2602:294:0:b39::166

;; Mattermost
mattermost		A	15.204.87.20
			AAAA	2604:2dc0:202:300::7c6 ; mattermost1 (OVH US/Oregon)

;; Puppet
puppet181		CNAME	puppet181.fsslc.wtnet.

; Service Aliases
ai			CNAME	llm191.fsslc.wtnet.
ldap			CNAME	ldap171.fsslc.wtnet.
logging			CNAME	graylog161.fsslc.wtnet.
opensearch		CNAME	os151.fsslc.wtnet.
opensearch-mw		CNAME	os162.fsslc.wtnet.
swift-lb		CNAME	swiftproxy161.fsslc.wtnet.

; Load Balanced (Cloudflare)
analytics		CNAME	cf-lb.miraheze.org.
grafana			CNAME	cf-lb.miraheze.org.
monitoring		CNAME	cf-lb.miraheze.org.
phorge-static		CNAME	cf-lb.miraheze.org.
static			CNAME	cf-lb.miraheze.org.
status			CNAME	cf-lb.miraheze.org.

; Healthcheck
health			DYNA	geoip!cp

; Static Help Documentation
$ORIGIN static.@Z
help			CNAME	miraheze.github.io.

; SSL Verification
_acme-challenge.wikitide.net.			TXT	"VDX-B98TZVnsvxCLKi3ZfF7Gwz4peY5bqzsM3AkDPBM"
_acme-challenge.wikitide.net.			TXT	"CO6cjG2fgvg5QP5YLV8pxzdv59NoGUUJ4IYZMLkeftk"
_acme-challenge.wikitide.net.			TXT	"Jplf27n0E4ABEddFOzrIqanY5dFwNqhutdjczujbnXY"
_acme-challenge.wikitide.net.			TXT	"-rhLZNBVVjFPsUuHlyfVIkiKrz_ORLe2P5qwrfU1JRQ"
_acme-challenge.wikitide.net.			TXT	"fFNU851qkFO-b_rDokLTOGMhY-0tpbn9mulsAxyLkoo"