Domain Connect: one-click DNS setup — waiting on upstream template merge

[jal-co]

Status

The core implementation and manual DNS fallback are shipped. The upstream template merged on July 14, 2026. One-click setup now depends on per-provider adoption, production signing-secret configuration, and a real-domain end-to-end verification.

Done

• Settings → Verified domains uses domain-sdk's DnsRecordsTable (copy-ready TXT with pending/valid status) and OneClickDnsSetup gated behind real discovery — the button can never render unless the user's DNS provider reports our template.
• discoverDomainConnect (apps/web/src/lib/domains.ts) implements the spec: _domainconnect TXT via DoH, provider settings fetch, template-support check, and RSA-SHA256-signed synchronous apply URL (DOMAIN_CONNECT_SIGNING_KEY, key _dck1).
• Signing public key published at _dck1.modulora.dev.
• Template passed dc-template-linter and online-editor apex/subdomain tests.
• Upstream add Modulora, Modulora domain verification Domain-Connect/Templates#1384 merged via the queue as commit 654f376.

Remaining

• Re-test discovery against a GoDaddy-hosted domain after that provider imports the merged template; its template check must return 200 before Modulora renders the one-click panel.
• Add DOMAIN_CONNECT_SIGNING_KEY to production Worker secrets.
• Verify the signed apply flow end-to-end on a real domain: provider review screen, TXT write, and successful Modulora verification.
• Document providers confirmed to have enabled the template; adoption is per-provider and on their schedule.

Safety

• Manual DNS remains the fallback until real discovery reports support.
• Never rotate the private signing key without updating _dck1.modulora.dev in the same change.

[jal-co]

Audit update: lower to post-alpha priority. Manual DNS fallback works and external-sale verification is optional; one-click remains dependent on upstream template merge, provider adoption, production signing-key setup, and a real-domain signed-flow test.

[jal-co]

Production update: configured DOMAIN_CONNECT_SIGNING_KEY after confirming the local RSA public key exactly matches the published _dck1.modulora.dev record. PR #96 also removes the extra Start verification step: tool submissions now prepare the TXT fallback automatically and render the one-click provider action whenever real discovery confirms that provider has imported the Modulora template. shieldcn.dev currently falls back to TXT because its DNS provider does not advertise the template.