sam/sns-network-solutions
1
0
Fork 0
Code Issues 31 Pull Requests 5 Actions Packages Projects Releases Wiki Activity
b1a35783bb
sns-network-solutions/infra/sns-digital/dns-and-domains.md
Samuel James b1a35783bb Consolidate 7 divisions to 3: Networking, Digital, Support 
- Merge Infrastructure + Secure + Systems → SNS Networking (Business #1)
- Merge Web + Software + Cloud → SNS Digital (planned)
- SNS Support unchanged (planned)
- Add infra/ folder with 16 FOSS-first buildable designs
- Update all agent knowledge, division briefs, legal structure
- Restructure businesses/ from 7 to 3 operating folders
2026-07-18 13:08:23 -05:00

2.9 KiB
Raw Blame History

DNS & Domain Management — SNS Digital

Entity: SNS Digital · Status: Buildable now

What it is

Centralized DNS management strategy. Public DNS on Route53 (cheap, reliable, API-driven). Internal DNS on AdGuard Home (split-horizon for private services).

Architecture

Public (internet-facing)              Internal (on-prem only)
┌─────────────────────┐              ┌─────────────────────────┐
│  AWS Route53        │              │  AdGuard Home (LXC)     │
│                     │              │                         │
│  snsnetlabs.com     │              │  *.internal.sns → 192.168.122.x │
│  client-domain.com  │              │  *.wg.internal  → 10.10.0.x     │
│  (delegated zones)  │              │                         │
└─────────────────────┘              └─────────────────────────┘

Public DNS (Route53)

Record Purpose
snsnetlabs.com Primary business domain
A / CNAME → Caddy public IP or Cloudflare Client sites
MX → Google Workspace Email
TXT SPF/DKIM/DMARC Email auth
CAA Restrict cert issuance to Let's Encrypt

Why Route53 over self-hosted DNS: $0.50/zone/month, 100% SLA, no maintenance. DNS is the one thing you don't want to self-host — if it goes down, everything goes down.

Internal DNS (AdGuard Home)

  • Runs on Proxmox LXC.
  • Resolves *.internal.sns to local service IPs.
  • Blocks ads/telemetry for all on-prem devices.
  • Upstream: Cloudflare DoH (https://dns.cloudflare.com/dns-query).

Domain Registration

  • Registrar: Cloudflare Registrar (at-cost, no markup) or Porkbun (cheap, good UI).
  • Rule: All client domains registered under the client's own account. SNS never holds a client's domain hostage.
  • SNS-owned domains: registered under Sam's account, Route53 for DNS.

Build Steps

  1. Register domain at Cloudflare/Porkbun.
  2. Create Route53 hosted zone → get NS records.
  3. Point registrar NS to Route53.
  4. Add records via Ansible (amazon.aws.route53 module) or Terraform.
  5. For internal: add entry to AdGuard Home's DNS rewrites.

Security Posture

  • DNSSEC: Enable on Route53 for SNS-owned zones.
  • CAA records: Restrict to letsencrypt.org only — prevents rogue cert issuance.
  • DMARC: p=reject on all owned domains once SPF/DKIM confirmed working.
  • Registrar lock: Transfer lock enabled on all production domains.
  • No wildcard DNS on public zones unless explicitly needed (reduces attack surface).

Upgrade Path

  • Terraform-managed DNS: When zone count exceeds 5, manage all Route53 records in Terraform for version control and drift detection.
  • PowerDNS: If Route53 cost becomes a factor at scale (unlikely at $0.50/zone).