# DNS & Domain Management — SNS Digital

**Entity:** SNS Digital · **Status:** Buildable now

## What it is

Centralized DNS management strategy. Public DNS on Route53 (cheap, reliable, API-driven).
Internal DNS on AdGuard Home (split-horizon for private services).

## Architecture

```
Public (internet-facing)              Internal (on-prem only)
┌─────────────────────┐              ┌─────────────────────────┐
│  AWS Route53        │              │  AdGuard Home (LXC)     │
│                     │              │                         │
│  snsnetlabs.com     │              │  *.internal.sns → 192.168.122.x │
│  client-domain.com  │              │  *.wg.internal  → 10.10.0.x     │
│  (delegated zones)  │              │                         │
└─────────────────────┘              └─────────────────────────┘
```

## Public DNS (Route53)

| Record | Purpose |
|--------|---------|
| `snsnetlabs.com` | Primary business domain |
| `A` / `CNAME` → Caddy public IP or Cloudflare | Client sites |
| `MX` → Google Workspace | Email |
| `TXT` SPF/DKIM/DMARC | Email auth |
| `CAA` | Restrict cert issuance to Let's Encrypt |

**Why Route53 over self-hosted DNS:** $0.50/zone/month, 100% SLA, no maintenance.
DNS is the one thing you don't want to self-host — if it goes down, everything goes down.

## Internal DNS (AdGuard Home)

- Runs on Proxmox LXC.
- Resolves `*.internal.sns` to local service IPs.
- Blocks ads/telemetry for all on-prem devices.
- Upstream: Cloudflare DoH (`https://dns.cloudflare.com/dns-query`).

## Domain Registration

- **Registrar:** Cloudflare Registrar (at-cost, no markup) or Porkbun (cheap, good UI).
- **Rule:** All client domains registered under the client's own account. SNS never
  holds a client's domain hostage.
- **SNS-owned domains:** registered under Sam's account, Route53 for DNS.

## Build Steps

1. Register domain at Cloudflare/Porkbun.
2. Create Route53 hosted zone → get NS records.
3. Point registrar NS to Route53.
4. Add records via Ansible (`amazon.aws.route53` module) or Terraform.
5. For internal: add entry to AdGuard Home's DNS rewrites.

## Security Posture

- **DNSSEC:** Enable on Route53 for SNS-owned zones.
- **CAA records:** Restrict to `letsencrypt.org` only — prevents rogue cert issuance.
- **DMARC:** `p=reject` on all owned domains once SPF/DKIM confirmed working.
- **Registrar lock:** Transfer lock enabled on all production domains.
- **No wildcard DNS on public zones** unless explicitly needed (reduces attack surface).

## Upgrade Path

- **Terraform-managed DNS:** When zone count exceeds 5, manage all Route53 records
  in Terraform for version control and drift detection.
- **PowerDNS:** If Route53 cost becomes a factor at scale (unlikely at $0.50/zone).