Prompt: set up a domain's DNS records (web, mail, verification)
Have an agent bring a zone hosted on ird DNS to a desired record set —
web endpoints, mail (MX, SPF, DKIM, DMARC), service verification TXTs,
CAA — as a reviewed plan applied without collateral changes.
Needs: ird access (MCP server or the ird CLI, logged in); the zone must already be on ird DNS (dns_list_zones)
Costs: record edits are free; hosting bills a tiny amount per record-hour (credits_prices → recurring.dns-zone-hourly)
Group: domains & dns
Paste everything below the line into a fresh conversation. Fill in the
FILL IN block first.
Task
Make the zone below serve the records in WANT, touching nothing else.
Show me the plan (adds, replacements, deletions) before applying it.
FILL IN
ZONE: example.ro
WANT: # one record per line: <name> <type> <value...> [ttl=N]
@ A 203.0.113.10
@ AAAA 2001:db8::10
www CNAME @
@ MX 10 mail.example.ro
@ TXT "v=spf1 include:_spf.example.net -all"
_dmarc TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.ro"
s1._domainkey TXT "v=DKIM1; k=rsa; p=MIIB…"
@ CAA 0 issue "letsencrypt.org"
_acme-challenge.api TXT "paste-from-provider"
DELETE: # records to remove, or "none"
old A
Non-negotiable rules
- Plan, then apply. Read the zone first, diff it against WANT, show
the diff, wait for a yes. No edits before that.
- Whole record sets.
dns_set_record replaces every value of that
name+type. To keep an existing TXT next to a new one (several TXTs at
the apex are normal: SPF plus verification strings), send the merged
list in one call — never drop values WANT did not mention unless
DELETE says so.
- Apex is never a CNAME. If WANT asks for
@ CNAME, refuse that
line and propose an A/AAAA instead.
- Only WANT and DELETE. The apex SOA/NS ird publishes, and any record
not named in WANT or DELETE, stay exactly as they are.
Steps
A. Read. dns_list_zones — ZONE must be listed (own or delegated;
a shared zone marked sensitive by its owner refuses edits, report that).
dns_get_zone(ZONE) (CLI: ird dns records <ZONE>) → current records +
nameservers.
B. Normalize WANT. Names become fully qualified with a trailing dot:
@ → ZONE., www → www.ZONE., _dmarc → _dmarc.ZONE.. Values map
to the typed data shape: A/AAAA {address}, CNAME/NS {name} (a
target of @ is ZONE.; hostnames get a trailing dot), MX
{preference, exchange}, TXT {texts: [...]} (each string ≤255 chars;
split a long DKIM key into several strings of one text record), SRV
{priority, weight, port, target}, CAA {flags, tag, value}. ttl=
overrides the zone default.
C. Diff. For each name+type in WANT: add (not in zone), replace
(in zone, different values — show old and new), keep (identical). For
each DELETE line: delete with the values that go away. Sanity checks to
flag in the plan: a CNAME next to any other record at the same name
(invalid); SPF with more than one TXT starting v=spf1 (invalid); a
hostname served by the ird IPFS gateway or a tunnel that would gain an
AAAA (the gateway is IPv4-only and a stray AAAA blocks its certificate).
D. Wait for my confirmation.
E. Apply. One dns_set_record(domain=ZONE, name, type, data, ttl)
per add/replace (CLI: ird dns set ZONE <name> <type> <values> --ttl N),
one dns_delete_record(domain=ZONE, name, type) per delete (omit
type only if I asked to remove every type at that name). Apply in this
order: deletions of CNAMEs that conflict, then adds/replaces, then the
rest of the deletions.
F. Verify. dns_get_zone(ZONE) must match WANT for every line. With a
shell: dig +short <type> <name> @<nameserver> against each of the zone's
nameservers for a sample of names, then against a public resolver
(@1.1.1.1) — public answers lag up to the old TTL. For mail, remind me
that SPF/DKIM/DMARC take effect for new mail only once resolvers see them.
Deliverable
The applied diff as a table (name, type, action, final values, TTL), the
zone's nameservers, and any line from WANT you refused, with the reason.