Prompt: run your own nameservers under your .ro domain

Have an agent delegate a .ro domain registered at ird to nameservers you run yourself under that same domain (ns1.example.ro, ns2.example.ro): the glue records at the registry, the delegation change, the dig +trace proof that the world reaches your servers, what to do with the ird-hosted zone afterwards, and the way back if it goes wrong.

Needs: the ird CLI, logged in (ird domains hosts, ird domains nameservers and ird dns disable are CLI-only); two or more servers already answering authoritatively for the zone (an ird VPS works); dig in a shell Costs: glue and nameserver changes at the registry (credits_prices → domains.hosts.per_change, domains.nameservers.per_change); the ird zone keeps its hourly fee (recurring.dns-zone-hourly) until disabled; your servers bill wherever they run (recurring.vps-hourly.<tier> on ird) Group: domains & dns

Paste everything below the line into a fresh conversation. Fill in the FILL IN block first.

Task

Point DOMAIN at the nameservers in NS_HOSTS, with glue, and verify the delegation from the root down. The ird zone stays up until the new delegation is proven; every registry change is confirmed by me first.

FILL IN

DOMAIN:     example.ro
NS_HOSTS:                            # label and IPv4 (second IP allowed), one per line
  ns1  203.0.113.10
  ns2  198.51.100.20
ZONE_PLAN:  disable                  # disable = off ird DNS after verification | keep = leave it (unused, still billed)

Non-negotiable rules

1. The servers answer before the registry hears about them. Each NS_HOSTS entry must answer authoritatively for DOMAIN (step B) or the delegation waits.
2. Confirm each registry change. The help doesn't say whether hosts add/set/delete and nameservers prompt: show the command, wait for my yes, never pass --yes. ird domains nameservers DOMAIN ns1 ns2 replaces the whole list.
3. No DS during the move. If list_domains shows dsdata or ird domains dsdata list DOMAIN is non-empty, stop and point me to the dnssec-enable prompt's rollback — a published DS plus new nameservers is a dark domain.
4. The ird zone dies last. ird dns disable only after step E passes, on my yes.
5. Don't poll. Parent-zone checks once when I ask.

Steps

A. Facts. list_domains (CLI: ird domains list) → current nameservers, dsdata. ird domains hosts list DOMAIN → existing glue. dns_get_zone(domain=DOMAIN) (CLI: ird dns records DOMAIN --json) → save to ./dns/DOMAIN-export.json; every record in it must exist on your servers, or names vanish at cutover. Also list what ird writes into this zone itself: ipns_list, ipfs_domains, list_tunnels, apps_list, p2p_list_apps — names under DOMAIN there need the zone on ird DNS (ipns_create, ipfs_domain_add, apps_deploy require an ird-hosted zone; p2p_domain_add auto-creates its record only there); those records become yours to keep by hand.

B. Pre-check the servers. For each NS_HOSTS IP: dig SOA DOMAIN @<ip> +norecursive → aa flag set; dig NS DOMAIN @<ip> → lists every NS_HOSTS name; dig A ns1.DOMAIN @<ip> → its own IP (the zone itself must carry the A records of ns1/ns2 — glue only helps the parent); the SOA serial equal on all servers; each export record answered as ird answers it. Any failure = stop; report server and query.

C. Glue. Per NS_HOSTS line: ird domains hosts add DOMAIN <host> <ip> [ip2]. The help doesn't say whether <host> is the label (ns1) or the full name; try the label, then the full name if refused, and report which it took. An existing host with other IPs: ird domains hosts set DOMAIN <host> <ip> [ip2] (replaces its IPs). ird domains hosts list DOMAIN must show each with the right addresses.

D. Delegate. ird domains nameservers DOMAIN ns1.DOMAIN ns2.DOMAIN — all of them, one command; then ird domains nameservers DOMAIN alone shows the result. list_domains → nameservers agrees.

E. Verify from the root. dig NS DOMAIN +trace — the last referral, from the .ro servers, must name every NS_HOSTS entry, with their IPs in the additional section (that is the glue). Then from a public resolver: dig +short NS DOMAIN @1.1.1.1 and dig +short A www.DOMAIN @1.1.1.1 = what your servers answer. Parents usually update within an hour, sometimes 24 h; check once when I ask.

F. The ird zone. ZONE_PLAN keep: nothing — it still bills hourly. ZONE_PLAN disable: after E passes and the old NS TTL has passed, ird dns disable DOMAIN (the help says only "take a domain off ird DNS" — the export file is the copy). dns_list_zones should no longer list DOMAIN.

G. Reversal, if I ask. ird dns enable DOMAIN (copies the live records from your servers by default; the zone comes back on ird nameservers — dns_get_zone shows which), ird domains nameservers DOMAIN <those nameservers>, verify as in E, then ird domains hosts delete DOMAIN <host> per glue entry — last, once the delegation no longer names them.

Deliverable

Glue as hosts list shows it, the nameservers as the registry shows them, the +trace tail (the .ro referral with glue) and the public resolver answers, whether the ird zone is disabled or still billing, records ird used to manage that are now yours, and the reversal commands with values filled in.