Prompt: move a zone off ird dns without downtime
Have an agent take a zone ird hosts — a .ro registered here, or a
domain from another registrar brought in with a claim — to another DNS
host cleanly: export every record, rebuild and verify the zone at the
new host, switch the delegation, confirm the domain answers from there,
and only then release the claim or disable the zone, checking that the
hourly zone fee actually stops.
Needs: ird access (MCP server or the ird CLI, logged in); an account at the new DNS host; for a .ro the CLI (ird domains nameservers and ird dns disable are CLI-only); for a claimed domain, you at your registrar's panel; dig in a shell
Costs: leaving is free — dns_claim_release is free per its description, claim reads are dns.manage requests, a .ro nameserver change is domains.nameservers.per_change; the zone's hourly fee (credits_prices → recurring.dns-zone-hourly) runs until the zone is gone
Group: domains & dns
Paste everything below the line into a fresh conversation. Fill in the
FILL IN block first.
Task
Move DOMAIN's DNS from ird to NEW_NS with no gap in resolution, then end
the hosting on ird. Nothing is released or disabled until the domain
answers from the new host and I say so.
FILL IN
DOMAIN: example.com
KIND: claimed # claimed = non-.ro brought onto ird DNS (dns_claim_list) | ro = a .ro registered at ird
NEW_NS: ns1.dns.example.net, ns2.dns.example.net # the new host's nameservers
OUT_FILE: ./dns/example.com-export.json
Non-negotiable rules
- Export first, to disk, verbatim. OUT_FILE exists before anything
else.
- Verify the new host before the switch. Every exported record
answers at NEW_NS (step C) or we don't switch.
- Release last.
dns_claim_release says it: a domain still
pointing at the claim's nameservers goes dark, and releasing an
already-ended claim answers 409; nothing reopens one — a new claim
would be needed. ird dns disable likewise only after step E and
my yes.
- Don't poll. Parent-zone checks once when I ask; the registrar
change is mine.
- DS first. A DS at the parent plus new nameservers is a dark
domain: if step A finds one, stop and use the
dnssec-enable
prompt's rollback before continuing.
Steps
A. Facts. dns_list_zones (CLI: ird dns list) — if DOMAIN shows
delegated=true it belongs to another account: stop, its owner
leaves. KIND claimed: dns_claim_list (CLI: ird dns claims list) →
the claim's id and state (must be active). KIND ro: list_domains
→ nameservers, dsdata; plus ird dns dnssec DOMAIN status. Also
list what ird maintains in this zone itself: ipns_list,
ipfs_domains, list_tunnels, apps_list, p2p_list_apps — names
under DOMAIN there need the zone on ird DNS (ipns_create,
ipfs_domain_add, apps_deploy require an ird-hosted zone;
p2p_domain_add auto-creates its record only there); they must be
moved or retired first.
B. Export. dns_get_zone(domain=DOMAIN) (CLI: ird dns records
DOMAIN --json) → save verbatim to OUT_FILE, then show a table (name,
type, values, TTL). The apex SOA and NS are ird's own — the new host
publishes its own; every other record is recreated.
C. Rebuild at the new host (its panel or API — not an ird step).
Then, for every record in OUT_FILE: dig +short <type> <name> @<one of
NEW_NS> must equal the export; also dig SOA DOMAIN @<each NEW_NS>
with the aa flag. Report the diff; nothing missing before D.
D. Switch. KIND claimed: I set NEW_NS at my registrar — print them
verbatim in a code block and wait. KIND ro: ird domains nameservers
DOMAIN <NEW_NS...> (replaces the whole list; show the command, wait
for my yes). Then, once when I ask: dig +short NS DOMAIN @1.1.1.1
lists NEW_NS (parents update within an hour, sometimes 24 h).
E. Confirm from outside. dig +short A www.DOMAIN @1.1.1.1, the
MX and one TXT — the answers match OUT_FILE without any @ird
nameserver. Wait out the old NS TTL from the export before F.
F. End the hosting, on my yes.
- claimed:
dns_claim_release(claim=DOMAIN) (CLI: ird dns claims
release DOMAIN). Free; the claim becomes revoked with
end_reason: released and ird keeps a snapshot of the records; 409
means it had already ended.
- ro:
ird dns disable DOMAIN. The help says only "take a domain off
ird DNS" — OUT_FILE is the copy.
G. The fee stops. dns_list_zones no longer lists DOMAIN;
dns_claim_list shows the claim ended. ird credits ledger --kind
charge --limit 50 — the hourly zone lines for DOMAIN should stop
after the release hour; check once the next day, not in a loop; report
the ledger's own wording.
H. Not leaving — an empty zone at activation. If instead DOMAIN is
mid-claim (state: pending) and you want the zone to start with no
records: dns_claim_seed_drop(claim=DOMAIN) (CLI: ird dns claims
seed DOMAIN --drop) removes the attached copy; the zone then starts
EMPTY at activation and the domain does not resolve until records are
added with dns_set_record. Only while pending (409 afterwards),
charged dns.manage. Confirm with me first.
Deliverable
OUT_FILE path and the record table, the NEW_NS verification diff
(should be empty), nameservers as the parent now shows them, the
public-resolver answers, the claim's final state (or the dns disable
output), ird-managed names that were moved or retired, and the ledger
line proving the zone fee stopped.