---
name: domain-management
description: Manage DNS records for free subdomains — registration, A/AAAA/CNAME/MX/TXT records, health checks, DNS verification. Covers loc.cc (NodeLoc/domain.nodeloc.com) and similar free subdomain providers.
---

# Domain Management — DNS Records

Manage DNS records for free subdomains. Covers `loc.cc` (NodeLoc `domain.nodeloc.com`) and similar providers.

## Triggers

- "зарегистрируй домен", "добавь DNS", "A-запись", "пропиши домен"
- "домен не резолвится", "DNS не работает", "проверь DNS"
- User gives domain registrar credentials and asks to fix DNS

## Workflow

### 1. Verify current DNS state FIRST

```bash
# Check authoritative nameservers
nslookup <domain> ns1.<nsprovider>.com
nslookup <domain> ns2.<nsprovider>.com

# Check public resolvers
nslookup <domain> 8.8.8.8
nslookup <domain> 1.1.1.1
```

Do NOT claim DNS "works" until at least one public resolver returns the IP. Google DNS (8.8.8.8) is slow to propagate; Cloudflare (1.1.1.1) is faster.

### 2. Get the external IP

```bash
curl -s ifconfig.me
```

### 3. NodeLoc (domain.nodeloc.com) — API + Browser

#### Login API

```bash
curl -s "https://domain.nodeloc.com/api/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"email":"<email>","password":"<password>"}'
# Returns: {"token":"<jwt>","user":{"id":...,"username":"..."}}
```

#### List domains

```bash
curl -s "https://domain.nodeloc.com/api/domains" \
  -H "Authorization: Bearer <token>"
```

#### Add DNS records — BROWSER REQUIRED

No REST API for DNS records. Must use browser:

1. Login via `browser_navigate` → `browser_type` → `browser_click`
2. Navigate to domain → click "DNS" button
3. Click "添加 DNS 记录" (Add DNS Record)
4. Fill form: Name (`@`), Type (`A`), Value (`<ip>`), TTL (`3600`)
5. **CRITICAL**: `browser_click` on the "创建" (Create) button may NOT work. Use `browser_console` instead:

```js
var btns = document.querySelectorAll('button');
for (var i = 0; i < btns.length; i++) {
  if (btns[i].textContent.trim() === '创建') { btns[i].click(); break; }
}
```

6. Verify record appears in table with "已同步" (Synced) status
7. Check authoritative NS immediately: `nslookup <domain> ns1.nodelook.com`

#### Pitfalls

- **Token truncation**: `terminal` and `read_file` truncate JWT tokens with `...`. Use `execute_code` + `subprocess.run()` to get the full token. See `hermes-tool-workarounds` for pattern.
- **Domain suspended**: If domain shows "suspended" with health check failure, adding a valid A record + port forwarding fixes it. Health check needs the server to actually respond on the target IP.
- **MX records "待处理"**: The provider's DNS sync sometimes shows MX records as pending. This is a provider-side issue; the A record syncs fine.
- **Google DNS slow**: Google DNS (8.8.8.8) can take hours to propagate. Always verify with authoritative NS first, then Cloudflare (1.1.1.1).

### 4. Verify external accessibility

After DNS resolves, verify the port is actually reachable:

```bash
curl -s --connect-timeout 5 http://<ip>:<port>/health
```

Timeout = port not forwarded. Check:
- Windows firewall: `netsh advfirewall firewall show rule name=all dir=in | grep <port>`
- Router: `curl -s --connect-timeout 3 http://<router-ip>` to identify router type (ASUS = `/Main_Login.asp`)

### 5. Port forwarding checklist

If external access times out:
1. Windows firewall rule exists for the port? → `netsh advfirewall firewall show rule`
2. Router port forwarding configured? → Router admin panel
3. ISP blocks the port? → Try port 443 or use Cloudflare Tunnel

## Verification

```bash
# Authoritative DNS
nslookup <domain> <ns1>  # Must return IP

# Public DNS (at least one)
nslookup <domain> 1.1.1.1  # Cloudflare — fast
nslookup <domain> 8.8.8.8  # Google — slow

# External access
curl -s http://<domain>:<port>/health  # Must return 200
```