Docs

Appearance

ciriussupport.com — NS Delegation Fix and Email Security ​

Story: EMAILSEC-013 (was EMAILSEC-009 in prior numbering) Owner: Rory (registrar access) — DNS records already staged in zone, only the registrar NS change is blocking. Status: Pending registrar change at U2 Web.

1. What is ciriussupport.com? ​

Secondary domain used as a support-contact address for external partners and on printed/support material (tickets, invoices, vendor comms). The domain is receive-mostly — incoming mail routes to Microsoft 365 (Exchange Online) for the ciriusgroup.com tenant:

$ dig +short MX ciriussupport.com @8.8.8.8
0 ciriussupport-com.mail.protection.outlook.com.

There is no operational need for outbound sending from this domain; any support response goes out from the agent's ciriusgroup.com mailbox.

2. The NS Delegation Problem ​

The public parent delegation still points at an old hosting provider that no longer serves the zone:

$ dig +short NS ciriussupport.com @8.8.8.8
ns1.servers-serving.net.
ns2.servers-serving.net.
ns3.servers-serving.net.

The authoritative zone data — including the DMARC and SPF records we have already staged — is hosted at generic.host on the same VPS that serves ciriusgroup.com:

$ dig +short SOA ciriussupport.com @ns1.vps-ciriusgroup.generic.host
ns1.vps-ciriusgroup.generic.host. hostmaster.ciriussupport.com. 2026041102 3600 3600 1209600 86400

$ dig +short TXT _dmarc.ciriussupport.com @ns1.vps-ciriusgroup.generic.host
"v=DMARC1; p=reject;rua=mailto:rory@ciriusgroup.com"

The zone exists, is serving data, and has DMARC p=reject. Because the parent (the .com zone at Verisign via the registrar) still delegates to servers-serving.net, which is not authoritative, public DNS resolvers never reach the records. Anyone in the world querying _dmarc.ciriussupport.com gets NXDOMAIN, which means:

  • DMARC enforcement is effectively p=none for the public Internet.
  • Spoofers who forge From: someone@ciriussupport.com bypass DMARC checks.
  • Maester and external DMARC checkers report the domain as noncompliant.

Timeline (inferred from records) ​

  • ~2015: domain registered; nameservers set to servers-serving.net (the old provider). This is visible as the current parent delegation.
  • Unknown date: DNS zone migrated to generic.host (same VPS as ciriusgroup.com), but the registrar NS records were never updated to match.
  • Since migration: every zone edit (MX, SPF, DMARC) has been invisible publicly; mail still flows in because Microsoft 365 publishes MX via its own tenant mapping at domain onboarding, and the old NS host presumably still returns the same MX record.
  • 2026-04-16: EMAILSEC-013 raised to close the gap.

3. Records Needed / Present in the generic.host Zone ​

These records already exist in the generic.host zone. They will become live once NS delegation is fixed.

RecordNameValueStatus
TXT (DMARC)_dmarc.ciriussupport.comv=DMARC1; p=reject; rua=mailto:rory@ciriusgroup.comPresent in zone, not publicly resolvable until NS fixed
TXT (SPF)ciriussupport.comv=spf1 include:spf.protection.outlook.com -allPresent — publicly resolvable because queried via M365 caching? (see §4)
MXciriussupport.com0 ciriussupport-com.mail.protection.outlook.com.Publicly resolvable
DKIM—Not configured (see §4)Receive-only; not required today

Recommended post-fix record set ​

After NS is corrected, update the zone to the canonical Cirius DMARC format and (optionally) lock SPF down to receive-only:

RecordNameValueChange
TXT (DMARC)_dmarc.ciriussupport.comv=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; rua=mailto:dmarc@ciriusgroup.com; ruf=mailto:dmarc@ciriusgroup.com; fo=1Normalize to match the ciriusgroup.com/ciriusdde.com template
TXT (SPF)ciriussupport.comv=spf1 -allTighten to hardfail-all since domain is receive-only — no authorized senders at all
DKIM——Not needed (no outbound)

Using v=spf1 -all (no include:) is the correct stance for a non-sending domain — any claim to be from:ciriussupport.com will fail SPF, and with p=reject + aspf=s the receiver will drop the message. This is a stronger posture than the current include:spf.protection.outlook.com -all, which authorizes the entire M365 shared SPF range.

4. Why the Existing SPF/MX Resolve Today ​

The servers-serving.net nameservers likely still return stale copies of historical records (MX → outlook.com, SPF → outlook.com include). That is why mail still flows inbound despite the broken delegation. We cannot rely on that indefinitely — the old host may retire or sanitize those records without notice.

The DMARC record was added after the zone move, so it exists only at generic.host and does not exist in the stale servers-serving.net copies. That is the direct observable proof of the delegation gap.

5. Fix — Who Needs to Act ​

5.1 Rory (registrar — U2 Web for ciriusgroup.com portfolio) ​

  1. Log into the U2 Web registrar control panel.
  2. Open the ciriussupport.com domain → Nameservers.
  3. Change nameservers from:
    ns1.servers-serving.net
ns2.servers-serving.net
ns3.servers-serving.net
    to:
    ns1.vps-ciriusgroup.generic.host
ns2.vps-ciriusgroup.generic.host
  4. Save. Propagation at the .com TLD typically happens within 1-2 hours; full worldwide convergence within 24-48 hours.

5.2 Kobe (verification — run once delegation is changed) ​

# Confirm parent delegation has updated at a gTLD server
dig NS ciriussupport.com @a.gtld-servers.net

# Expected:
# ciriussupport.com.  172800  IN  NS  ns1.vps-ciriusgroup.generic.host.
# ciriussupport.com.  172800  IN  NS  ns2.vps-ciriusgroup.generic.host.

# Once public recursive resolvers pick it up (~30 min - 2h):
dig +short NS ciriussupport.com @8.8.8.8
dig +short TXT _dmarc.ciriussupport.com @8.8.8.8
# Expected DMARC: v=DMARC1; p=reject; ...

5.3 Rory (after verification — zone polish at generic.host) ​

  1. Normalize the DMARC record per §3 recommended record set.
  2. Tighten SPF to v=spf1 -all per §3 recommended record set.
  3. Close EMAILSEC-013 with the verification dig output attached.

6. Terraform / azure-infra ​

No changes. ciriussupport.com is not a DNS zone in azure-infra. The only DNS resources in azure-infra are azurerm_private_dns_zone (privatelink). If we eventually migrate all Cirius public zones into Azure DNS, ciriussupport.com would come along with them under a dedicated migration story.

7. Risk / Blast Radius Assessment ​

ChangeRiskMitigation
NS delegation flipBrief propagation window where some resolvers return old servers-serving.net data and others return the new generic.host dataThe zone content on both sides returns the same MX for outlook.com, so inbound mail continues to flow during the split-brain window. DMARC becomes enforced more strictly on resolvers that see the new NS — any spoof attempt during the window fails, which is the desired state.
SPF tightened to -all (no includes)If any vendor was silently sending on behalf of ciriussupport.com, their mail would start DMARC-failing and get rejectedAudit Exchange Online message trace for any outbound mail with From: *@ciriussupport.com in the last 90 days before tightening. If zero, safe to apply. If non-zero, identify the sender and include them in SPF before tightening.
DMARC rua= pointing at rory@ciriusgroup.comReports clutter inboxChange to dmarc@ciriusgroup.com (group mailbox or distribution list) per §3 recommended record set — enables DMARC analyzer ingestion later.

References ​

Internal use only — Cirius Group