Nameserver delegation and DNSSEC live at the registrar, not at Cloudflare. scripthammer.com
is registered with Squarespace, which publishes no public API for
nameservers
— those settings are dashboard-only.
So during the #635 migration, a CLOUDFLARE_API_TOKEN scoped correctly for DNS work did
everything on the Cloudflare side unattended — enumerated the imported records, deleted both
orphaned Mailgun MX entries, unproxied _domainconnect, verified the three Resend records,
registered the routing destination — and then stopped dead at two clicks it had no authority
to make:
- Disabling DNSSEC
- Repointing the nameservers
Both are registrar actions. Neither is automatable while registration sits at Squarespace.
Why this is worth fixing rather than tolerating
It is once-per-domain, so the cost looks trivial. What it actually costs is that the riskiest
step in the whole migration is the one no tooling can check first.
DNSSEC is the example. scripthammer.com had an active DS record
(12965 8 2 31d59d25…). Switching nameservers with that in place makes every validating
resolver return SERVFAIL — the domain goes dark for a large share of the internet, and
stays dark until the DS is removed and that propagates. Cloudflare mentions it under
"Recommended", below the fold, in the same visual weight as "only allow Cloudflare IPs at your
origin" (which does not even apply to a GitHub Pages origin).
It was caught by querying for a DS record before touching anything, not by the UI. A registrar
under the same API would let that check be a precondition rather than a habit.
The fix
Transfer registration of scripthammer.com to Cloudflare Registrar. Then nameservers,
DNSSEC and renewals fall under the same token that already manages the records.
- The option is offered in the dashboard per domain (geolarp.com currently shows
"Registrar: Google · Transfer to Cloudflare").
- Requires an authorization code from Squarespace and the domain to be unlocked.
- Takes several days; ICANN also blocks transfer within 60 days of registration or a previous
transfer.
- Cloudflare Registrar sells at wholesale cost with no markup, so this is usually cheaper than
Squarespace as well.
Do this AFTER #635 settles
Not during. A registrar transfer while nameservers are mid-propagation stacks two independent
failure modes on the same domain, and one of them is the DNSSEC/SERVFAIL trap above. Wait for
the zone to read active, mail to admin@ to actually arrive, and the site to be verified
through the proxy.
Definition of done
Related: #635 (the migration that surfaced this) · #769 (admin@ depends on it)
Nameserver delegation and DNSSEC live at the registrar, not at Cloudflare.
scripthammer.comis registered with Squarespace, which publishes no public API for
nameservers
— those settings are dashboard-only.
So during the #635 migration, a
CLOUDFLARE_API_TOKENscoped correctly for DNS work dideverything on the Cloudflare side unattended — enumerated the imported records, deleted both
orphaned Mailgun MX entries, unproxied
_domainconnect, verified the three Resend records,registered the routing destination — and then stopped dead at two clicks it had no authority
to make:
Both are registrar actions. Neither is automatable while registration sits at Squarespace.
Why this is worth fixing rather than tolerating
It is once-per-domain, so the cost looks trivial. What it actually costs is that the riskiest
step in the whole migration is the one no tooling can check first.
DNSSEC is the example.
scripthammer.comhad an active DS record(
12965 8 2 31d59d25…). Switching nameservers with that in place makes every validatingresolver return SERVFAIL — the domain goes dark for a large share of the internet, and
stays dark until the DS is removed and that propagates. Cloudflare mentions it under
"Recommended", below the fold, in the same visual weight as "only allow Cloudflare IPs at your
origin" (which does not even apply to a GitHub Pages origin).
It was caught by querying for a DS record before touching anything, not by the UI. A registrar
under the same API would let that check be a precondition rather than a habit.
The fix
Transfer registration of
scripthammer.comto Cloudflare Registrar. Then nameservers,DNSSEC and renewals fall under the same token that already manages the records.
"Registrar: Google · Transfer to Cloudflare").
transfer.
Squarespace as well.
Do this AFTER #635 settles
Not during. A registrar transfer while nameservers are mid-propagation stacks two independent
failure modes on the same domain, and one of them is the DNSSEC/SERVFAIL trap above. Wait for
the zone to read
active, mail toadmin@to actually arrive, and the site to be verifiedthrough the proxy.
Definition of done
active, site serving through Cloudflare,admin@receiving real mail
CLOUDFLARE_API_TOKEN.env.examplenote updated — the token's documented limits change once the registrar movesgeolarp.com, which is on Google and has the identical splitRelated: #635 (the migration that surfaced this) · #769 (
admin@depends on it)