# Domains and DNS

Company DNS zones in Cloudflare, records with guards for MX, NS and apex, and subdomains of the ArduMaker zone.

Source: https://ardumaker.com/en/docs/dominios-y-dns/

- Category: Servers and infrastructure
- Status: Available
- Requirements: A company in ArduMaker; To add or delete a domain and to edit records: being a company admin; To create records: being a company member or admin; Access to the registrar panel where the domain was bought, to change its nameservers
- MCP tools (Read only): `listar_dominios_empresa`, `ver_dominio_empresa`, `ver_estado_ns_dominio`, `listar_registros_dns`, `verificar_dominio_vps`
- MCP tools (Write or modify): `crear_dominio_empresa`, `crear_registro_dns`, `crear_dominio_vps`
- MCP tools (Destructive): `eliminar_dominio_empresa`, `editar_registro_dns`

## What can you do with it?

### The company's own domains

- Add a domain: ArduMaker creates its zone in Cloudflare and returns the nameservers it has to point to.
- Check whether the nameservers already point there (`is_connected`) and the zone status.
- List, create and edit A, AAAA, CNAME, MX, TXT, NS, SRV and CAA records.
- Remove a domain from the company (soft delete: the zone and its records are untouched, and it can be reactivated).

### Subdomains of the ArduMaker zone

- Create a subdomain of the platform zone pointing to a VPS, without owning a domain.
- Check where any domain resolves before publishing it on a VPS.

## When should you use it?

- Moving a domain's DNS management to ArduMaker to use it with VPS, email and apps.
- Adding the records an external service asks for (TXT verification, mail MX, CAA).
- Trying an app quickly with a subdomain of the ArduMaker zone.

## How does it work in ArduMaker?

### Connecting your own domain

1. An admin adds the domain (`crear_dominio_empresa`). The zone is created in Cloudflare and `name_servers` is returned. If the domain was deleted in the same company, it is reactivated instead of duplicated. If it belongs to another company, it is rejected.
2. At the registrar, the nameservers are replaced with the ones ArduMaker returned.
3. `ver_estado_ns_dominio` queries Cloudflare live and stores the status; `is_connected: true` means the delegation is active.
4. From then on, records are managed in ArduMaker.

### Records and their guards

- **Critical records**: any `MX` or `NS`, and an `A` or `AAAA` at the apex (empty name, `@` or the domain itself). Creating or editing them without `confirmado=true` answers 409 with `requiere_confirmacion` and the reason.
- **Content**: an `A` must be an IPv4 address and an `AAAA` an IPv6 address (`dns_contenido_invalido`). Cloudflare validates the rest, and its rejection arrives as `dns_rechazado`.
- **Limit**: 10 creations or changes per company per minute. The Cloudflare API budget is shared by all customers; past the cap the answer is 429.
- **Editing replaces** the whole record (it is not a field merge).
- `ttl: 1` means automatic. `proxied` only applies to A, AAAA and CNAME; `priority` to MX and SRV.

### Subdomains of the ArduMaker zone

`crear_dominio_vps` always creates a **CNAME** to the VPS `dnsip` (`<slug>.<zone>`), with the Cloudflare proxy on. Name rules: one or two levels before the zone, each at least 3 characters long, with letters, digits and hyphens in the middle. If the record already exists and points elsewhere, it is rejected; if it already points to this VPS, it comes back as `exists`.

Each VPS has its `dnsip`, a name in the ArduMaker zone that replaces the host's real IP across the API. For your own domain, a CNAME to that `dnsip` or an A record to the IP it resolves to is enough.

## What actually changes?

- In Cloudflare: the domain zone and the records created or edited. DNS changes take time to propagate even if corrected right away.
- In ArduMaker: the domain row (status `active` or `deleted`) and an audit entry for each record creation, edit or deletion, with who did it, the domain and the record.
- If the company is pending identity verification, its zones may be paused until it is verified.

## Diagram

**DNS chain from a domain to a VPS**

```text
Registrar (Cloudflare nameservers)
  ↓
Cloudflare zone (company records)
  ↓
CNAME / A (to the VPS dnsip or the IP it resolves to)
  ↓
VPS host (nginx publishes the domain (see Nginx))
```

## Expected result

- `crear_dominio_empresa` returns `name_servers`, `cloudflare_status` and `already_existed`.
- `ver_estado_ns_dominio` and `ver_dominio_empresa` show `is_connected` and `name_servers`; if Cloudflare does not answer, the domain still comes back with `cloudflare_error`.
- Created or edited records come back with the full Cloudflare object (`id`, `type`, `name`, `content`, `proxied`, `ttl`).
- To publish the domain on a VPS, continue with [Nginx](https://ardumaker.com/en/docs/nginx) and [SSL certificates](https://ardumaker.com/en/docs/ssl).

## Errors and troubleshooting

| Answer | Cause | What to do |
| --- | --- | --- |
| 409 `requiere_confirmacion` | Critical record (MX, NS, A/AAAA at the apex) | Review and resend the same call with `confirmado=true` |
| 429 | More than 10 DNS changes per minute in the company | Wait a minute |
| 400 `dns_contenido_invalido` | Wrong IP for A or AAAA | Fix the content |
| 400 `dns_rechazado` | Cloudflare rejected the record (duplicate, format) | Read the message and fix it |
| 424 `dependencia_externa` | Cloudflare did not answer; nothing was changed | Retry in a moment |
| 403 `unauthorized_admin_access_required` | The operation is for company admins only | Ask an admin |
| `is_connected: false` | The registrar nameservers do not point to Cloudflare yet | Change them at the registrar and wait for propagation |

> **PRECAUCION:** `crear_registro_dns` and `crear_dominio_empresa` are not idempotent by themselves: to retry after a cut, use the same `idempotency_key` and the same arguments, or the record is duplicated.

## MCP access

Yes. The company domain tools are in the `/mcp` and `/mcp/infra` profiles; the VPS subdomain tools are in `/mcp` and `/mcp/vps`.

| Tool | Type | Notes |
| --- | --- | --- |
| `listar_dominios_empresa`, `ver_dominio_empresa`, `ver_estado_ns_dominio`, `listar_registros_dns` | Read | Zone and record status |
| `crear_dominio_empresa` | Write | Admin only; accepts `idempotency_key` |
| `crear_registro_dns` | Write | Member or admin; `confirmado` for critical records |
| `editar_registro_dns` | Destructive | Admin only; replaces the whole record |
| `eliminar_dominio_empresa` | Destructive | Admin only; soft delete, reversible with `crear_dominio_empresa` |
| `verificar_dominio_vps`, `crear_dominio_vps` | Read / Write | Zone subdomains to a VPS |

**Deleting a DNS record has no MCP tool**, on purpose: it is irreversible on the spot and its effect propagates outwards. It is done from the panel. Reference at [/mcp/docs](https://ardumaker.com/en/mcp/docs) and examples at [/mcp/dominios](https://ardumaker.com/en/mcp/dominios).

## Related features

- [Nginx](https://ardumaker.com/en/docs/nginx/)
- [SSL certificates](https://ardumaker.com/en/docs/ssl/)
- [Professional email](https://ardumaker.com/en/docs/correo-profesional/)
- [VPS servers](https://ardumaker.com/en/docs/vps/)