From 6d72d656425a548cddb7776621b228ebc3b4e780 Mon Sep 17 00:00:00 2001
From: Ryan Malloy <ryan@supported.systems>
Date: Thu, 21 May 2026 11:14:42 -0600
Subject: [PATCH] Retire prepare-zones.sh pipeline; zones/ is now the served
 form

Big migration: the source/prepared split is gone. Each zones/*.zone is
now an RFC-compliant zone file that CoreDNS reads directly. Editing a
record is just edit + bump SOA + commit. CoreDNS auto-reloads within
30s; HE pulls on its own 300s SOA-refresh cycle.

Why: groundwork for the coredns-rfc2136 plugin to edit zones in place
without juggling a source/prepared transformation step. Also reduces
the mental model from "edit source, run prep, push" to just "edit".

Changes:
- zones/*.zone: 84 files migrated from Vultr-export form to RFC-compliant
  form (SOA injected, Vultr NS replaced with HE NS, CNAME/MX/NS rdata
  dot-terminated, apex lines get explicit @ prefix). Diff is mechanical
  and byte-count is unchanged (~340K) -- pure formatting promotion.
- docker-compose.yml: bind ./zones:/zones:ro (was ./zones-prepared)
- Makefile: dropped 'prep' target. 'reload' is now a no-op explainer.
  'tls-up' no longer depends on prep. 'clean' no longer wipes prepared.
- scripts/prepare-zones.sh moved to scripts/archive/ (kept for reference).
- .gitignore: updated comment for zones-prepared/ (now legacy).

NOT in this commit (follow-ups):
- CLAUDE.md updates documenting the new workflow.
- scripts/bump-serials.sh helper for manual-edit SOA bumping.
- coredns-rfc2136 plugin refactor (Phase 2b in the plan).
---
 .gitignore                             |   5 +-
 Makefile                               |  30 ++++--
 docker-compose.yml                     |   2 +-
 scripts/{ => archive}/prepare-zones.sh |   0
 zones/acrazy.org.zone                  |  40 +++++---
 zones/automaton.global.zone            |  34 +++++--
 zones/automaton.host.zone              |  30 ++++--
 zones/blender.bet.zone                 |  30 ++++--
 zones/blender.cam.zone                 |  30 ++++--
 zones/blender.partners.zone            |  30 ++++--
 zones/blender.quest.zone               |  30 ++++--
 zones/blender.systems.zone             |  34 +++++--
 zones/cloud-dine.com.zone              |  32 +++++--
 zones/context.bet.zone                 |  34 +++++--
 zones/coopermalloy.com.zone            |  36 ++++++--
 zones/copper-springs.online.zone       |  38 +++++---
 zones/cyberinsuranceapp.com.zone       |  30 ++++--
 zones/demo-tube.com.zone               |  32 +++++--
 zones/demostar.app.zone                |  32 +++++--
 zones/demostar.click.zone              |  30 ++++--
 zones/demostar.io.zone                 |  52 +++++++----
 zones/demostar.net.zone                |  32 +++++--
 zones/dignity.ink.zone                 |  34 +++++--
 zones/dope.team.zone                   |  30 ++++--
 zones/encom.cash.zone                  |  30 ++++--
 zones/encom.ink.zone                   |  30 ++++--
 zones/encom.website.zone               |  30 ++++--
 zones/encom.wtf.zone                   |  30 ++++--
 zones/enls.us.zone                     |  32 +++++--
 zones/enls.video.zone                  |  30 ++++--
 zones/freemyradicals.com.zone          |  30 ++++--
 zones/garage.ceo.zone                  |  30 ++++--
 zones/garage.christmas.zone            |  30 ++++--
 zones/garage.doctor.zone               |  30 ++++--
 zones/garage.dog.zone                  |  30 ++++--
 zones/garage.engineering.zone          |  30 ++++--
 zones/garage.makeup.zone               |  30 ++++--
 zones/garage.rocks.zone                |  30 ++++--
 zones/garage.supply.zone               |  30 ++++--
 zones/glennsferry.site.zone            |  30 ++++--
 zones/home-inspector.app.zone          |  30 ++++--
 zones/home-inspector.pics.zone         |  30 ++++--
 zones/home-inspector.site.zone         |  30 ++++--
 zones/home-inspector.store.zone        |  38 +++++---
 zones/home-inspector.website.zone      |  30 ++++--
 zones/homestar.ink.zone                |  36 ++++++--
 zones/inpect.pro.zone                  |  32 +++++--
 zones/inspect.monster.zone             |  30 ++++--
 zones/inspect.pics.zone                |  34 +++++--
 zones/inspect.systems.zone             |  42 ++++++---
 zones/inspects.homes.zone              |  32 +++++--
 zones/jobsite.homes.zone               |  30 ++++--
 zones/kg7q.cc.zone                     |  34 +++++--
 zones/log.doctor.zone                  |  36 +++++---
 zones/lukascrockett.com.zone           |  32 +++++--
 zones/malloys.us.zone                  |  50 ++++++----
 zones/mcp.website.zone                 |  30 ++++--
 zones/mcpdash.wtf.zone                 |  30 ++++--
 zones/myhood.us.zone                   |  34 +++++--
 zones/nielsen-inspections.com.zone     |  48 ++++++----
 zones/nielsens.world.zone              |  32 +++++--
 zones/ourjob.site.zone                 |  34 +++++--
 zones/paigemalloy.com.zone             |  32 +++++--
 zones/paythatway.com.zone              |  30 ++++--
 zones/powdercoatedcabinents.com.zone   |  30 ++++--
 zones/powdercoatedcabinet.com.zone     |  30 ++++--
 zones/powdercotedcabinets.com.zone     |  30 ++++--
 zones/prezhub.com.zone                 |  30 ++++--
 zones/reviewr.guru.zone                |  32 +++++--
 zones/rsvp-for.de.zone                 |  30 ++++--
 zones/ryanmalloy.com.zone              |  42 ++++++---
 zones/screencast.systems.zone          |  30 ++++--
 zones/septic.report.zone               |  38 +++++---
 zones/sidejob.pro.zone                 |  38 +++++---
 zones/spencernewbolt.com.zone          |  32 +++++--
 zones/supported.systems.zone           | 121 ++++++++++++++-----------
 zones/supportedsystems.com.zone        |  32 +++++--
 zones/supportedsystems.net.zone        |  30 ++++--
 zones/syslog.chat.zone                 |  30 ++++--
 zones/tatemalloy.com.zone              |  36 ++++++--
 zones/tateorrtot.games.zone            |  32 +++++--
 zones/timber.ink.zone                  |  34 +++++--
 zones/trackfeeds.cloud.zone            |  34 +++++--
 zones/tuckermalloy.com.zone            |  32 +++++--
 zones/upc.llc.zone                     |  58 +++++++-----
 zones/warehack.ing.zone                |  38 +++++---
 zones/westboise.org.zone               |  36 ++++++--
 zones/zmesh.systems.zone               |  40 +++++---
 88 files changed, 2125 insertions(+), 795 deletions(-)
 rename scripts/{ => archive}/prepare-zones.sh (100%)

diff --git a/.gitignore b/.gitignore
index 14d1699..a0faaaa 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,7 @@
-# Prepared zones are generated from zones/ by scripts/prepare-zones.sh
+# Legacy: zones-prepared/ was the generated form when scripts/prepare-zones.sh
+# (now in scripts/archive/) processed zones/. We retired that pipeline in
+# favour of editing zones/*.zone directly as RFC-compliant served files.
+# If anyone runs the archived script, the output stays out of git.
 zones-prepared/*.zone
 
 # Self-signed certs (re-generated by scripts/generate-certs.sh)
diff --git a/Makefile b/Makefile
index 40d057a..1cb37cb 100644
--- a/Makefile
+++ b/Makefile
@@ -6,15 +6,24 @@ COMPOSE := docker compose
 include .env
 export
 
-.PHONY: help prep certs up down restart logs logs-caddy ps test test-tls \
+.PHONY: help certs up down restart logs logs-caddy ps test test-tls \
         test-public reload clean tls-up cert-watch caddy-rebuild
 
 help: ## Show this help
 	@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {printf "  \033[36m%-14s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)
 
-prep: ## Re-inject SOA + bump serial, then NOTIFY all secondaries (auto-fires AXFR)
-	@./scripts/prepare-zones.sh
-	@./scripts/notify-secondaries.py --quiet || echo "  (NOTIFY had failures; secondaries will still re-poll on SOA refresh)"
+# ---------------------------------------------------------------------------
+# Zone-file edits are now direct: edit zones/*.zone, bump SOA serial,
+# commit. CoreDNS's auto plugin reloads within 30s. HE pulls on its
+# SOA-refresh cycle (300s by zone SOA setting).
+#
+# For manual edits, scripts/bump-serials.sh helps bump CalVer-style
+# serials for zones changed since HEAD. RFC 2136 UPDATEs (via the
+# coredns-rfc2136 plugin) bump serials themselves and auto-commit.
+#
+# The legacy prepare-zones.sh / make prep / notify-he.py pipeline is
+# retired — kept in scripts/archive/ for reference. See CLAUDE.md.
+# ---------------------------------------------------------------------------
 
 certs: ## Generate self-signed dev cert (only useful if not using Caddy ACME)
 	@./scripts/generate-certs.sh
@@ -26,7 +35,7 @@ caddy-rebuild: ## Rebuild the Caddy image (after editing caddy/Dockerfile)
 # Production / Let's Encrypt flow
 # ---------------------------------------------------------------------------
 
-tls-up: prep ## Bring up Caddy → wait for cert → start CoreDNS (one command)
+tls-up: ## Bring up Caddy → wait for cert → start CoreDNS (one command)
 	@if [ -z "$$VULTR_API_KEY" ]; then \
 		echo "ERROR: VULTR_API_KEY is not exported. Set it in your shell:"; \
 		echo "  export VULTR_API_KEY=..."; \
@@ -61,11 +70,12 @@ logs-caddy: ## Tail Caddy logs
 down: ## Stop & remove all containers
 	$(COMPOSE) down
 
-restart: ## Restart CoreDNS (does not re-prep zones / re-issue cert)
+restart: ## Restart CoreDNS (does not re-issue cert)
 	$(COMPOSE) restart coredns
 
-reload: prep ## Re-prep zones; CoreDNS auto-plugin picks changes up
-	@echo "Zones re-prepared. CoreDNS reloads files every 30s (auto plugin)."
+reload: ## Touch zone files so CoreDNS auto plugin picks them up promptly
+	@echo "CoreDNS auto plugin polls zones/ every 30s — no action needed."
+	@echo "If you just edited a zone, ensure the SOA serial was bumped."
 
 logs: ## Tail CoreDNS logs
 	$(COMPOSE) logs -f coredns
@@ -97,8 +107,8 @@ test-public: ## Smoke-test using the public hostname (DoT/DoH ports must be open
 	@echo "=== DoH on public hostname @ port 443 ==="
 	@dig @$(CADDY_HOSTNAME) +https cloudflare.com A +short
 
-clean: down ## Remove containers + prepared zones + dev self-signed certs
-	rm -rf zones-prepared/*.zone certs/*.pem
+clean: down ## Remove containers + dev self-signed certs
+	rm -f certs/*.pem
 
 clean-caddy: down ## Also wipe Caddy's data dir (forces re-issuance from scratch!)
 	@echo "About to delete caddy-data/ — this will force re-issuance from LE."
diff --git a/docker-compose.yml b/docker-compose.yml
index a635d5a..b8746ec 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -53,7 +53,7 @@ services:
       - "${HEALTH_PORT}:8080/tcp"
     volumes:
       - ./Corefile:/etc/coredns/Corefile:ro
-      - ./zones-prepared:/zones:ro
+      - ./zones:/zones:ro
       # Subpath mount of Caddy's data dir. The healthcheck maintains
       # cert.pem / key.pem symlinks at the top of this tree, so CoreDNS
       # sees stable filenames regardless of hostname. The /accounts dir
diff --git a/scripts/prepare-zones.sh b/scripts/archive/prepare-zones.sh
similarity index 100%
rename from scripts/prepare-zones.sh
rename to scripts/archive/prepare-zones.sh
diff --git a/zones/acrazy.org.zone b/zones/acrazy.org.zone
index c00e2e4..e70a2e4 100644
--- a/zones/acrazy.org.zone
+++ b/zones/acrazy.org.zone
@@ -1,19 +1,35 @@
-; Zone file for acrazy.org
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/acrazy.org.zone
 $ORIGIN acrazy.org.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.acrazy.org. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
 or	300	IN	A	74.91.22.233
-l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net
-*.l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net
+l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net.
+*.l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net.
 b	300	IN	A	108.61.23.129
 dootie	300	IN	A	108.61.23.129
-*	300	IN	CNAME	acrazy.org
-*.dootie	300	IN	CNAME	dootie.acrazy.org
-	300	IN	MX	10	acrazy.org
+*	300	IN	CNAME	acrazy.org.
+*.dootie	300	IN	CNAME	dootie.acrazy.org.
+@	300	IN	MX	10	acrazy.org.
 _acme-challenge	300	IN	TXT	"eIA2Ii4EA7cfmjVcTUvOrM5nc4nFRRYpjvxtpEYzPG4"
 _acme-challenge	300	IN	TXT	"DQxkmE7D658WT3-MR5xa7x5NW85L0C8Xq80Iv9-ZF60"
 _acme-challenge	300	IN	TXT	"uOz583TEOpuME0AiJgaZYusECS8VDCP55yBuGw9WL58"
@@ -39,6 +55,4 @@ _acme-challenge.l	300	IN	TXT	"Ike1gqcB3VI7WwKoH3T8zqbpYSo2qRPrq0iqzB5wmFU"
 _acme-challenge.langfuse.dootie	300	IN	TXT	"1WJ-mHJ2SQuuC5CgxbYY6euwiMZm1dVicfIkeluovTY"
 _acme-challenge.dootie.l	300	IN	TXT	"uW30ozl6AKA_q9FWPlvaxuwbgBJ-TgTsXxA3JFtn0tg"
 _acme-challenge.langfuse.dootie.l	300	IN	TXT	"P6tOVfwB8OBbI6AqnIuHXKQc05FjuABhGihUHwzpMOs"
-; Explicit CNAMEs added to fix RFC 4592 empty-non-terminal cases
-; (parent name has _acme-challenge children, so wildcard would skip it)
-langfuse.dootie	300	IN	CNAME	acrazy.org
+langfuse.dootie	300	IN	CNAME	acrazy.org.
diff --git a/zones/automaton.global.zone b/zones/automaton.global.zone
index a54d1ed..5ec3b77 100644
--- a/zones/automaton.global.zone
+++ b/zones/automaton.global.zone
@@ -1,17 +1,33 @@
-; Zone file for automaton.global
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/automaton.global.zone
 $ORIGIN automaton.global.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.automaton.global. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	144.202.93.19
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	144.202.93.19
 cloud	300	IN	A	144.202.93.19
 join	300	IN	A	108.61.194.241
 jump	900	IN	A	134.215.239.30
 jump1	3600	IN	A	134.215.239.30
 test	300	IN	A	1.2.3.4
-*	300	IN	CNAME	automaton.global
-mail	300	IN	CNAME	mail.supported.systems
-	300	IN	MX	10	mail.supported.systems
-	300	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
\ No newline at end of file
+*	300	IN	CNAME	automaton.global.
+mail	300	IN	CNAME	mail.supported.systems.
+@	300	IN	MX	10	mail.supported.systems.
+@	300	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
diff --git a/zones/automaton.host.zone b/zones/automaton.host.zone
index 964e652..b06a4be 100644
--- a/zones/automaton.host.zone
+++ b/zones/automaton.host.zone
@@ -1,11 +1,27 @@
-; Zone file for automaton.host
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/automaton.host.zone
 $ORIGIN automaton.host.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.automaton.host. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	50.52.72.153
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	50.52.72.153
 krambu	300	IN	A	134.215.239.30
-*	300	IN	CNAME	automaton.host
-	300	IN	MX	10	mail.supported.systems
\ No newline at end of file
+*	300	IN	CNAME	automaton.host.
+@	300	IN	MX	10	mail.supported.systems.
diff --git a/zones/blender.bet.zone b/zones/blender.bet.zone
index cf70efa..d03f3a0 100644
--- a/zones/blender.bet.zone
+++ b/zones/blender.bet.zone
@@ -1,10 +1,26 @@
-; Zone file for blender.bet
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/blender.bet.zone
 $ORIGIN blender.bet.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.blender.bet. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	blender.bet
-	300	IN	MX	10	blender.bet
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	blender.bet.
+@	300	IN	MX	10	blender.bet.
diff --git a/zones/blender.cam.zone b/zones/blender.cam.zone
index 923d637..574424b 100644
--- a/zones/blender.cam.zone
+++ b/zones/blender.cam.zone
@@ -1,10 +1,26 @@
-; Zone file for blender.cam
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/blender.cam.zone
 $ORIGIN blender.cam.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.blender.cam. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	blender.cam
-	300	IN	MX	10	blender.cam
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	blender.cam.
+@	300	IN	MX	10	blender.cam.
diff --git a/zones/blender.partners.zone b/zones/blender.partners.zone
index c27c036..4aa7ffb 100644
--- a/zones/blender.partners.zone
+++ b/zones/blender.partners.zone
@@ -1,10 +1,26 @@
-; Zone file for blender.partners
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/blender.partners.zone
 $ORIGIN blender.partners.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.blender.partners. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	blender.partners
-	300	IN	MX	10	blender.partners
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	blender.partners.
+@	300	IN	MX	10	blender.partners.
diff --git a/zones/blender.quest.zone b/zones/blender.quest.zone
index 74a560f..4800279 100644
--- a/zones/blender.quest.zone
+++ b/zones/blender.quest.zone
@@ -1,10 +1,26 @@
-; Zone file for blender.quest
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/blender.quest.zone
 $ORIGIN blender.quest.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.blender.quest. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	blender.quest
-	300	IN	MX	10	blender.quest
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	blender.quest.
+@	300	IN	MX	10	blender.quest.
diff --git a/zones/blender.systems.zone b/zones/blender.systems.zone
index e6bf1be..a6f087c 100644
--- a/zones/blender.systems.zone
+++ b/zones/blender.systems.zone
@@ -1,13 +1,29 @@
-; Zone file for blender.systems
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/blender.systems.zone
 $ORIGIN blender.systems.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.blender.systems. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
 l	300	IN	A	127.0.0.1
-*	300	IN	CNAME	blender.systems
-*.l	300	IN	CNAME	blender.systems
-	300	IN	MX	10	mail.supported.systems
-	300	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
\ No newline at end of file
+*	300	IN	CNAME	blender.systems.
+*.l	300	IN	CNAME	blender.systems.
+@	300	IN	MX	10	mail.supported.systems.
+@	300	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
diff --git a/zones/cloud-dine.com.zone b/zones/cloud-dine.com.zone
index 6105843..f3a52c1 100644
--- a/zones/cloud-dine.com.zone
+++ b/zones/cloud-dine.com.zone
@@ -1,11 +1,27 @@
-; Zone file for cloud-dine.com
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/cloud-dine.com.zone
 $ORIGIN cloud-dine.com.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.cloud-dine.com. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	72.24.184.132
-*	300	IN	CNAME	cloud-dine.com
-	300	IN	MX	10	mail.supported.systems
-	3600	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	72.24.184.132
+*	300	IN	CNAME	cloud-dine.com.
+@	300	IN	MX	10	mail.supported.systems.
+@	3600	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
diff --git a/zones/context.bet.zone b/zones/context.bet.zone
index 62cd0c7..d2cc52a 100644
--- a/zones/context.bet.zone
+++ b/zones/context.bet.zone
@@ -1,13 +1,29 @@
-; Zone file for context.bet
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/context.bet.zone
 $ORIGIN context.bet.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.context.bet. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	context.bet
-	300	IN	MX	10	context.bet
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	context.bet.
+@	300	IN	MX	10	context.bet.
 _acme-challenge.studio	300	IN	TXT	"Li380TywS7mThEIWuivl7P2Zkt3xM5Ug_dYEa-oN238"
 _acme-challenge.studio	300	IN	TXT	"KHzdoVgJnWS-pYx0MFaeqzMxkAKMIffHYBE-FgV_gz8"
 _acme-challenge	300	IN	TXT	"YvpqyCHZnlMxlA5I7PJu4FXLXRlObIdvTmd07P_Hctg"
@@ -30,6 +46,4 @@ _acme-challenge	300	IN	TXT	"FSMb7Ru6xgzIIUvlzSzzVnOsGQD2Dgxm_qhx6hyymnE"
 _acme-challenge	300	IN	TXT	"yB9kMNkHqVDe5vMvkgN5SFxiXgDSlSyUgldfW971BXw"
 _acme-challenge	300	IN	TXT	"dpheXmHW0vH_NW5t8Ie_OWXiJkZT0l2U2Yu9w5n5uZg"
 _acme-challenge	300	IN	TXT	"K6DYSkbn2Fk_P0fA1fxbIZszce4NzjTtgodaUNxDS1w"
-; Explicit CNAMEs added to fix RFC 4592 empty-non-terminal cases
-; (parent name has _acme-challenge children, so wildcard would skip it)
-studio	300	IN	CNAME	context.bet
+studio	300	IN	CNAME	context.bet.
diff --git a/zones/coopermalloy.com.zone b/zones/coopermalloy.com.zone
index 5322f0b..6b37545 100644
--- a/zones/coopermalloy.com.zone
+++ b/zones/coopermalloy.com.zone
@@ -1,15 +1,31 @@
-; Zone file for coopermalloy.com
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/coopermalloy.com.zone
 $ORIGIN coopermalloy.com.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.coopermalloy.com. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	coopermalloy.com
-mail	3600	IN	CNAME	mail.supported.systems
-	300	IN	MX	10	mail.supported.systems
-	3600	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	coopermalloy.com.
+mail	3600	IN	CNAME	mail.supported.systems.
+@	300	IN	MX	10	mail.supported.systems.
+@	3600	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
 _acme-challenge	300	IN	TXT	"EZLETkIGw-ztOqS8PxZ6ErG1wuFdbwUUo_hQ6Ouc1u0"
 _acme-challenge	300	IN	TXT	"YckMEs1aROXztwr7eHJksQ7VdR9GSKfMDujVL8BH25E"
 _acme-challenge	300	IN	TXT	"zSS6xNG4EIz1LLTRIcSmX2HBHTSRZVvy8kkgTYI2mSg"
@@ -21,4 +37,4 @@ _acme-challenge	300	IN	TXT	"SEIL9s7-r-rOHWnE-ZDeNPk_1f3iHfqGYjluAU6R4Xw"
 _acme-challenge	300	IN	TXT	"fZ9Wg4cJirtPEGr5JtR_aO4dSRZOtKLopug05hwJOU0"
 _acme-challenge	300	IN	TXT	"6LWS9nyupxDGygeRbBmWnkJyjZhMCxj-xZRZmRnzquw"
 _acme-challenge	300	IN	TXT	"JG5vKxfEqXH43AK3FEnPYwVc7TkADQ-PxgjdqfrpAgU"
-_acme-challenge	300	IN	TXT	"b9X8yKk78gcZ0mg8Wy-81_keh9ZetEBs08QNqUDuXr4"
\ No newline at end of file
+_acme-challenge	300	IN	TXT	"b9X8yKk78gcZ0mg8Wy-81_keh9ZetEBs08QNqUDuXr4"
diff --git a/zones/copper-springs.online.zone b/zones/copper-springs.online.zone
index 0a30820..ddd3ddb 100644
--- a/zones/copper-springs.online.zone
+++ b/zones/copper-springs.online.zone
@@ -1,16 +1,30 @@
-; Zone file for copper-springs.online
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/copper-springs.online.zone
 $ORIGIN copper-springs.online.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.copper-springs.online. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-dev	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net
-*	300	IN	CNAME	copper-springs.online
-*.dev	300	IN	CNAME	dev.copper-springs.online
-	300	IN	MX	10	copper-springs.online
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+dev	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net.
+*	300	IN	CNAME	copper-springs.online.
+*.dev	300	IN	CNAME	dev.copper-springs.online.
+@	300	IN	MX	10	copper-springs.online.
 _acme-challenge.docs.butler.dev	300	IN	TXT	"JcIKn8HyUtQMwY_q0FNdj-XfacQS9Tn5SQiwTKB79VE"
-; Explicit CNAMEs added to fix RFC 4592 empty-non-terminal cases
-; (parent name has _acme-challenge children, so wildcard would skip it)
-docs.butler.dev	300	IN	CNAME	copper-springs.online
+docs.butler.dev	300	IN	CNAME	copper-springs.online.
diff --git a/zones/cyberinsuranceapp.com.zone b/zones/cyberinsuranceapp.com.zone
index 1788ac8..198a267 100644
--- a/zones/cyberinsuranceapp.com.zone
+++ b/zones/cyberinsuranceapp.com.zone
@@ -1,10 +1,26 @@
-; Zone file for cyberinsuranceapp.com
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/cyberinsuranceapp.com.zone
 $ORIGIN cyberinsuranceapp.com.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.cyberinsuranceapp.com. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	144.202.104.200
-*	300	IN	CNAME	cyberinsuranceapp.com
-	300	IN	MX	10	cyberinsuranceapp.com
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	144.202.104.200
+*	300	IN	CNAME	cyberinsuranceapp.com.
+@	300	IN	MX	10	cyberinsuranceapp.com.
diff --git a/zones/demo-tube.com.zone b/zones/demo-tube.com.zone
index d72af71..3a2d585 100644
--- a/zones/demo-tube.com.zone
+++ b/zones/demo-tube.com.zone
@@ -1,12 +1,28 @@
-; Zone file for demo-tube.com
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/demo-tube.com.zone
 $ORIGIN demo-tube.com.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.demo-tube.com. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	demo-tube.com
-	300	IN	MX	10	demo-tube.com
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	demo-tube.com.
+@	300	IN	MX	10	demo-tube.com.
 _acme-challenge	300	IN	TXT	"-ucCFXSieY1TSGAAgfEnmNQY7C59R8d-VeCL7YWG80E"
-_acme-challenge	300	IN	TXT	"rl8mWufuTFr3fbO9Yq5XzLg8HvuU_SiwUdylOopo5Sk"
\ No newline at end of file
+_acme-challenge	300	IN	TXT	"rl8mWufuTFr3fbO9Yq5XzLg8HvuU_SiwUdylOopo5Sk"
diff --git a/zones/demostar.app.zone b/zones/demostar.app.zone
index 31c082f..cd940a0 100644
--- a/zones/demostar.app.zone
+++ b/zones/demostar.app.zone
@@ -1,11 +1,27 @@
-; Zone file for demostar.app
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/demostar.app.zone
 $ORIGIN demostar.app.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.demostar.app. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	72.24.184.132
-*	300	IN	CNAME	demostar.app
-	300	IN	MX	10	mail.supported.systems
-	300	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	72.24.184.132
+*	300	IN	CNAME	demostar.app.
+@	300	IN	MX	10	mail.supported.systems.
+@	300	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
diff --git a/zones/demostar.click.zone b/zones/demostar.click.zone
index 0fca07a..2aa6667 100644
--- a/zones/demostar.click.zone
+++ b/zones/demostar.click.zone
@@ -1,11 +1,27 @@
-; Zone file for demostar.click
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/demostar.click.zone
 $ORIGIN demostar.click.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.demostar.click. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	149.28.50.172
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	149.28.50.172
 analytics	300	IN	A	144.202.93.19
-*	300	IN	CNAME	demostar.click
-	300	IN	MX	10	mail.supported.systems
\ No newline at end of file
+*	300	IN	CNAME	demostar.click.
+@	300	IN	MX	10	mail.supported.systems.
diff --git a/zones/demostar.io.zone b/zones/demostar.io.zone
index acdfd7c..619f8a1 100644
--- a/zones/demostar.io.zone
+++ b/zones/demostar.io.zone
@@ -1,23 +1,39 @@
-; Zone file for demostar.io
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/demostar.io.zone
 $ORIGIN demostar.io.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.demostar.io. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.230
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.230
 ph	300	IN	A	144.202.60.236
 or	300	IN	A	74.91.22.233
 vdo	300	IN	A	74.91.22.230
-dev	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net
-*	300	IN	CNAME	demostar.io
-shynet	300	IN	CNAME	demostar.io
-oo-sandbox	300	IN	CNAME	oo.demostar.io
-oo	300	IN	CNAME	demostar.io
-cw	3600	IN	CNAME	demostar.io
-	300	IN	MX	10	mail.supported.systems
-	3600	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
-	3600	IN	TXT	"google-site-verification=2O9jXz4H-nx0oRi2hVdFCWnPudISRlpT2nWE0xF-U14"
+dev	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net.
+*	300	IN	CNAME	demostar.io.
+shynet	300	IN	CNAME	demostar.io.
+oo-sandbox	300	IN	CNAME	oo.demostar.io.
+oo	300	IN	CNAME	demostar.io.
+cw	3600	IN	CNAME	demostar.io.
+@	300	IN	MX	10	mail.supported.systems.
+@	3600	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
+@	3600	IN	TXT	"google-site-verification=2O9jXz4H-nx0oRi2hVdFCWnPudISRlpT2nWE0xF-U14"
 _acme-challenge.meet	300	IN	TXT	"6ZSVw9yrMNjG2z-KqLP77_FW7w0I7embcfCLc9g6CRs"
 _acme-challenge.oo-sandbox	300	IN	TXT	"o8a0j9u2-CmTCkAPJ9audd0SSh2KFv90vXPgLOoib_c"
 _acme-challenge	300	IN	TXT	"xfcM1eMV0DRZMxHWzY5_l4v8sEHe064XmrJpBn7KZik"
@@ -32,8 +48,6 @@ _acme-challenge.vdo	300	IN	TXT	"slcvr2gvi6ahNucyzfzLvInL-l0L1P93I2p3vQ3ytrU"
 _acme-challenge.vdo	300	IN	TXT	"cGxfMICfHYD7QiQmsAuWuVN-hQQoZ38GcvDTigsioWQ"
 _acme-challenge.cw.cw	300	IN	TXT	"Y0ahdJHcKysWxYNQG8aXQuWr0uSp7WVlwxkdWYHcrIM"
 _acme-challenge.cw	300	IN	TXT	"e7IRkthq2cwpEJHEjbAsQwqkvQGHl831X6luH3ct6uc"
-; Explicit CNAMEs added to fix RFC 4592 empty-non-terminal cases
-; (parent name has _acme-challenge children, so wildcard would skip it)
-cw.cw	300	IN	CNAME	demostar.io
-doom	300	IN	CNAME	demostar.io
-meet	300	IN	CNAME	demostar.io
+cw.cw	300	IN	CNAME	demostar.io.
+doom	300	IN	CNAME	demostar.io.
+meet	300	IN	CNAME	demostar.io.
diff --git a/zones/demostar.net.zone b/zones/demostar.net.zone
index 6f5e6b1..8ea7f67 100644
--- a/zones/demostar.net.zone
+++ b/zones/demostar.net.zone
@@ -1,12 +1,28 @@
-; Zone file for demostar.net
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/demostar.net.zone
 $ORIGIN demostar.net.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.demostar.net. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	140.82.13.104
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	140.82.13.104
 docker-zfs1.nj	300	IN	A	140.82.13.104
-*	300	IN	CNAME	demostar.net
-	300	IN	MX	10	mail.supported.systems
-	300	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
\ No newline at end of file
+*	300	IN	CNAME	demostar.net.
+@	300	IN	MX	10	mail.supported.systems.
+@	300	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
diff --git a/zones/dignity.ink.zone b/zones/dignity.ink.zone
index 46a71c9..cb293ee 100644
--- a/zones/dignity.ink.zone
+++ b/zones/dignity.ink.zone
@@ -1,13 +1,29 @@
-; Zone file for dignity.ink
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/dignity.ink.zone
 $ORIGIN dignity.ink.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.dignity.ink. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	108.61.23.129
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	108.61.23.129
 l	300	IN	A	10.20.0.38
-*	300	IN	CNAME	dignity.ink
-*.l	300	IN	CNAME	l.dignity.ink
-kayla	300	IN	CNAME	docker-2.supportedsystems.net
-	300	IN	MX	10	dignity.ink
\ No newline at end of file
+*	300	IN	CNAME	dignity.ink.
+*.l	300	IN	CNAME	l.dignity.ink.
+kayla	300	IN	CNAME	docker-2.supportedsystems.net.
+@	300	IN	MX	10	dignity.ink.
diff --git a/zones/dope.team.zone b/zones/dope.team.zone
index c488cc8..b651c51 100644
--- a/zones/dope.team.zone
+++ b/zones/dope.team.zone
@@ -1,11 +1,27 @@
-; Zone file for dope.team
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/dope.team.zone
 $ORIGIN dope.team.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.dope.team. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	108.61.23.129
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	108.61.23.129
 qube	300	IN	A	108.61.23.129
-*	300	IN	CNAME	dope.team
-	300	IN	MX	10	dope.team
\ No newline at end of file
+*	300	IN	CNAME	dope.team.
+@	300	IN	MX	10	dope.team.
diff --git a/zones/encom.cash.zone b/zones/encom.cash.zone
index d5ada7a..f09d02b 100644
--- a/zones/encom.cash.zone
+++ b/zones/encom.cash.zone
@@ -1,10 +1,26 @@
-; Zone file for encom.cash
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/encom.cash.zone
 $ORIGIN encom.cash.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.encom.cash. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	encom.cash
-	300	IN	MX	10	encom.cash
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	encom.cash.
+@	300	IN	MX	10	encom.cash.
diff --git a/zones/encom.ink.zone b/zones/encom.ink.zone
index 3c4d312..7f6d248 100644
--- a/zones/encom.ink.zone
+++ b/zones/encom.ink.zone
@@ -1,10 +1,26 @@
-; Zone file for encom.ink
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/encom.ink.zone
 $ORIGIN encom.ink.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.encom.ink. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	encom.ink
-	300	IN	MX	10	encom.ink
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	encom.ink.
+@	300	IN	MX	10	encom.ink.
diff --git a/zones/encom.website.zone b/zones/encom.website.zone
index aa904cd..a2b1fc5 100644
--- a/zones/encom.website.zone
+++ b/zones/encom.website.zone
@@ -1,10 +1,26 @@
-; Zone file for encom.website
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/encom.website.zone
 $ORIGIN encom.website.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.encom.website. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	encom.website
-	300	IN	MX	10	encom.website
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	encom.website.
+@	300	IN	MX	10	encom.website.
diff --git a/zones/encom.wtf.zone b/zones/encom.wtf.zone
index 79983d7..640c937 100644
--- a/zones/encom.wtf.zone
+++ b/zones/encom.wtf.zone
@@ -1,10 +1,26 @@
-; Zone file for encom.wtf
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/encom.wtf.zone
 $ORIGIN encom.wtf.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.encom.wtf. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	encom.wtf
-	300	IN	MX	10	encom.wtf
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	encom.wtf.
+@	300	IN	MX	10	encom.wtf.
diff --git a/zones/enls.us.zone b/zones/enls.us.zone
index 5131338..2e7da10 100644
--- a/zones/enls.us.zone
+++ b/zones/enls.us.zone
@@ -1,12 +1,28 @@
-; Zone file for enls.us
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/enls.us.zone
 $ORIGIN enls.us.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.enls.us. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	enls.us
-	300	IN	MX	10	enls.us
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	enls.us.
+@	300	IN	MX	10	enls.us.
 _acme-challenge	300	IN	TXT	"RpllERXufsL0PWSFs_5p980PX3twLnYM-JKt048e7iI"
-_acme-challenge	300	IN	TXT	"qGFOfoDwY0NHx-Xdo5aPQQ1z7wOQ3d4UJcbU17iL0WQ"
\ No newline at end of file
+_acme-challenge	300	IN	TXT	"qGFOfoDwY0NHx-Xdo5aPQQ1z7wOQ3d4UJcbU17iL0WQ"
diff --git a/zones/enls.video.zone b/zones/enls.video.zone
index 065e927..71e76cb 100644
--- a/zones/enls.video.zone
+++ b/zones/enls.video.zone
@@ -1,10 +1,26 @@
-; Zone file for enls.video
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/enls.video.zone
 $ORIGIN enls.video.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.enls.video. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	enls.video
-	300	IN	MX	10	enls.video
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	enls.video.
+@	300	IN	MX	10	enls.video.
diff --git a/zones/freemyradicals.com.zone b/zones/freemyradicals.com.zone
index b921d75..40707b7 100644
--- a/zones/freemyradicals.com.zone
+++ b/zones/freemyradicals.com.zone
@@ -1,10 +1,26 @@
-; Zone file for freemyradicals.com
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/freemyradicals.com.zone
 $ORIGIN freemyradicals.com.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.freemyradicals.com. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	freemyradicals.com
-	300	IN	MX	10	freemyradicals.com
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	freemyradicals.com.
+@	300	IN	MX	10	freemyradicals.com.
diff --git a/zones/garage.ceo.zone b/zones/garage.ceo.zone
index 9cb3f7b..435baaf 100644
--- a/zones/garage.ceo.zone
+++ b/zones/garage.ceo.zone
@@ -1,10 +1,26 @@
-; Zone file for garage.ceo
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/garage.ceo.zone
 $ORIGIN garage.ceo.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.garage.ceo. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	garage.ceo
-	300	IN	MX	10	garage.ceo
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	garage.ceo.
+@	300	IN	MX	10	garage.ceo.
diff --git a/zones/garage.christmas.zone b/zones/garage.christmas.zone
index aaedd61..3c4b51e 100644
--- a/zones/garage.christmas.zone
+++ b/zones/garage.christmas.zone
@@ -1,10 +1,26 @@
-; Zone file for garage.christmas
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/garage.christmas.zone
 $ORIGIN garage.christmas.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.garage.christmas. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	garage.christmas
-	300	IN	MX	10	garage.christmas
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	garage.christmas.
+@	300	IN	MX	10	garage.christmas.
diff --git a/zones/garage.doctor.zone b/zones/garage.doctor.zone
index 421f77f..dfb5647 100644
--- a/zones/garage.doctor.zone
+++ b/zones/garage.doctor.zone
@@ -1,10 +1,26 @@
-; Zone file for garage.doctor
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/garage.doctor.zone
 $ORIGIN garage.doctor.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.garage.doctor. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	garage.doctor
-	300	IN	MX	10	garage.doctor
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	garage.doctor.
+@	300	IN	MX	10	garage.doctor.
diff --git a/zones/garage.dog.zone b/zones/garage.dog.zone
index 766682d..2ab19fb 100644
--- a/zones/garage.dog.zone
+++ b/zones/garage.dog.zone
@@ -1,10 +1,26 @@
-; Zone file for garage.dog
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/garage.dog.zone
 $ORIGIN garage.dog.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.garage.dog. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	garage.dog
-	300	IN	MX	10	garage.dog
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	garage.dog.
+@	300	IN	MX	10	garage.dog.
diff --git a/zones/garage.engineering.zone b/zones/garage.engineering.zone
index 18f31ca..d916f35 100644
--- a/zones/garage.engineering.zone
+++ b/zones/garage.engineering.zone
@@ -1,10 +1,26 @@
-; Zone file for garage.engineering
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/garage.engineering.zone
 $ORIGIN garage.engineering.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.garage.engineering. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	garage.engineering
-	300	IN	MX	10	garage.engineering
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	garage.engineering.
+@	300	IN	MX	10	garage.engineering.
diff --git a/zones/garage.makeup.zone b/zones/garage.makeup.zone
index 60940cf..1def133 100644
--- a/zones/garage.makeup.zone
+++ b/zones/garage.makeup.zone
@@ -1,10 +1,26 @@
-; Zone file for garage.makeup
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/garage.makeup.zone
 $ORIGIN garage.makeup.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.garage.makeup. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	garage.makeup
-	300	IN	MX	10	garage.makeup
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	garage.makeup.
+@	300	IN	MX	10	garage.makeup.
diff --git a/zones/garage.rocks.zone b/zones/garage.rocks.zone
index b8f69b9..8b3b209 100644
--- a/zones/garage.rocks.zone
+++ b/zones/garage.rocks.zone
@@ -1,10 +1,26 @@
-; Zone file for garage.rocks
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/garage.rocks.zone
 $ORIGIN garage.rocks.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.garage.rocks. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	garage.rocks
-	300	IN	MX	10	garage.rocks
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	garage.rocks.
+@	300	IN	MX	10	garage.rocks.
diff --git a/zones/garage.supply.zone b/zones/garage.supply.zone
index bbd4f75..ac24d48 100644
--- a/zones/garage.supply.zone
+++ b/zones/garage.supply.zone
@@ -1,10 +1,26 @@
-; Zone file for garage.supply
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/garage.supply.zone
 $ORIGIN garage.supply.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.garage.supply. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	garage.supply
-	300	IN	MX	10	garage.supply
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	garage.supply.
+@	300	IN	MX	10	garage.supply.
diff --git a/zones/glennsferry.site.zone b/zones/glennsferry.site.zone
index 9d8ef7e..f5dcead 100644
--- a/zones/glennsferry.site.zone
+++ b/zones/glennsferry.site.zone
@@ -1,10 +1,26 @@
-; Zone file for glennsferry.site
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/glennsferry.site.zone
 $ORIGIN glennsferry.site.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.glennsferry.site. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	108.61.23.129
-*	300	IN	CNAME	glennsferry.site
-	300	IN	MX	10	glennsferry.site
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	108.61.23.129
+*	300	IN	CNAME	glennsferry.site.
+@	300	IN	MX	10	glennsferry.site.
diff --git a/zones/home-inspector.app.zone b/zones/home-inspector.app.zone
index 0feafb2..9e10565 100644
--- a/zones/home-inspector.app.zone
+++ b/zones/home-inspector.app.zone
@@ -1,10 +1,26 @@
-; Zone file for home-inspector.app
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/home-inspector.app.zone
 $ORIGIN home-inspector.app.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.home-inspector.app. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	home-inspector.app
-	300	IN	MX	10	home-inspector.app
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	home-inspector.app.
+@	300	IN	MX	10	home-inspector.app.
diff --git a/zones/home-inspector.pics.zone b/zones/home-inspector.pics.zone
index 96088f4..9261a25 100644
--- a/zones/home-inspector.pics.zone
+++ b/zones/home-inspector.pics.zone
@@ -1,10 +1,26 @@
-; Zone file for home-inspector.pics
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/home-inspector.pics.zone
 $ORIGIN home-inspector.pics.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.home-inspector.pics. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	home-inspector.pics
-	300	IN	MX	10	home-inspector.pics
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	home-inspector.pics.
+@	300	IN	MX	10	home-inspector.pics.
diff --git a/zones/home-inspector.site.zone b/zones/home-inspector.site.zone
index 258d1cf..7e929c0 100644
--- a/zones/home-inspector.site.zone
+++ b/zones/home-inspector.site.zone
@@ -1,10 +1,26 @@
-; Zone file for home-inspector.site
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/home-inspector.site.zone
 $ORIGIN home-inspector.site.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.home-inspector.site. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	home-inspector.site
-	300	IN	MX	10	home-inspector.site
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	home-inspector.site.
+@	300	IN	MX	10	home-inspector.site.
diff --git a/zones/home-inspector.store.zone b/zones/home-inspector.store.zone
index d805bfe..774b312 100644
--- a/zones/home-inspector.store.zone
+++ b/zones/home-inspector.store.zone
@@ -1,20 +1,34 @@
-; Zone file for home-inspector.store
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/home-inspector.store.zone
 $ORIGIN home-inspector.store.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.home-inspector.store. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	home-inspector.store
-	300	IN	MX	10	home-inspector.store
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	home-inspector.store.
+@	300	IN	MX	10	home-inspector.store.
 _acme-challenge.dashboard	300	IN	TXT	"TLTjv7weswoJMxQ8K897MGeez7RJlTTay7sJ5_OQY-M"
 _acme-challenge	300	IN	TXT	"qtDNogktSbMLdjkIQNciTHAIIKIIO7CKaOhIvg2PY7U"
 _acme-challenge.dashboard	300	IN	TXT	"U3yUObG_I0bU4lEiBQz_saa-U9ysq0lSRCqJcBwJi2I"
 _acme-challenge.api	300	IN	TXT	"LwzNwdpFoJsKzXbGhaV7nenwRFj9vDyIAokNLdV4zwE"
 _acme-challenge.mailpit	300	IN	TXT	"ZAfKxXBLnghzsFKBTXOIdFvEzgfu4zOny_Kqv3cF3AM"
-; Explicit CNAMEs added to fix RFC 4592 empty-non-terminal cases
-; (parent name has _acme-challenge children, so wildcard would skip it)
-api	300	IN	CNAME	home-inspector.store
-dashboard	300	IN	CNAME	home-inspector.store
-mailpit	300	IN	CNAME	home-inspector.store
+api	300	IN	CNAME	home-inspector.store.
+dashboard	300	IN	CNAME	home-inspector.store.
+mailpit	300	IN	CNAME	home-inspector.store.
diff --git a/zones/home-inspector.website.zone b/zones/home-inspector.website.zone
index 4600975..679cd1e 100644
--- a/zones/home-inspector.website.zone
+++ b/zones/home-inspector.website.zone
@@ -1,10 +1,26 @@
-; Zone file for home-inspector.website
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/home-inspector.website.zone
 $ORIGIN home-inspector.website.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.home-inspector.website. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	home-inspector.website
-	300	IN	MX	10	home-inspector.website
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	home-inspector.website.
+@	300	IN	MX	10	home-inspector.website.
diff --git a/zones/homestar.ink.zone b/zones/homestar.ink.zone
index 9dc384a..1dded5f 100644
--- a/zones/homestar.ink.zone
+++ b/zones/homestar.ink.zone
@@ -1,13 +1,29 @@
-; Zone file for homestar.ink
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/homestar.ink.zone
 $ORIGIN homestar.ink.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.homestar.ink. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	104.238.162.49
-l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net
-*.l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	104.238.162.49
+l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net.
+*.l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net.
 photos.mock-reso	300	IN	A	104.238.162.49
 tiles	300	IN	A	104.238.162.49
 auth	300	IN	A	104.238.162.49
@@ -23,8 +39,8 @@ help.demo	300	IN	A	144.202.24.151
 mock-api.demo	300	IN	A	144.202.24.151
 *.demo	300	IN	A	144.202.24.151
 photos.mock-reso.demo	300	IN	A	144.202.24.151
-*	300	IN	CNAME	homestar.ink
-	300	IN	MX	10	homestar.ink
+*	300	IN	CNAME	homestar.ink.
+@	300	IN	MX	10	homestar.ink.
 _acme-challenge.app.l	300	IN	TXT	"mvwfXPM6nlBHSQwHGqWRTXzvDEuSKLy8BibTPMSKXHA"
 _acme-challenge.app	300	IN	TXT	"SEAAW9v1r_gKgC9nyh4COloffktc-YjJKqt2NSkPU7Y"
 _acme-challenge.mcp	300	IN	TXT	"-TGB3voLmbRPvlVghG74Keb3Skqlq0mRqxSexA4umm4"
@@ -42,4 +58,4 @@ _acme-challenge.mock-api	300	IN	TXT	"KehJ8tjPUUz5c43-Ewc8iBv_Exf3JJjSbaXrWEhiw6g
 _acme-challenge	300	IN	TXT	"BbK7sPiEMhYBMaxSMyCQmqbL9zTfb3klFl4lcbipKsQ"
 _acme-challenge.auth	300	IN	TXT	"wYPRXeQdbLIetlJdqmk41yPGvgNjnTfEUa1nBMmvGgM"
 _acme-challenge.photos.mock-reso	300	IN	TXT	"IMnrty4nznAfRYib1anooATLTNoVsZ8UxwlQrgw12o4"
-_acme-challenge.mock-api.demo	300	IN	TXT	"rYEoJlrmu5pbmtj0dv7LUOLqgQNBVQLTnjqMxWV2NrE"
\ No newline at end of file
+_acme-challenge.mock-api.demo	300	IN	TXT	"rYEoJlrmu5pbmtj0dv7LUOLqgQNBVQLTnjqMxWV2NrE"
diff --git a/zones/inpect.pro.zone b/zones/inpect.pro.zone
index 1359491..d2e5cfa 100644
--- a/zones/inpect.pro.zone
+++ b/zones/inpect.pro.zone
@@ -1,13 +1,29 @@
-; Zone file for inpect.pro
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/inpect.pro.zone
 $ORIGIN inpect.pro.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.inpect.pro. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	inpect.pro
-	300	IN	MX	10	inpect.pro
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	inpect.pro.
+@	300	IN	MX	10	inpect.pro.
 _acme-challenge	300	IN	TXT	"ERZWm4IprjdR5YXus-BHtJmQ5q3tnd_HWy7S9JkZUIQ"
 _acme-challenge	300	IN	TXT	"6aefAQtyBbf0HZZazNsmogvRb-7TEjv2EfG-ydfxTww"
-_acme-challenge	300	IN	TXT	"sYEwgVBnqS5B3lL1IlKenuOHTB4dmFbMvYH7gN7HTOk"
\ No newline at end of file
+_acme-challenge	300	IN	TXT	"sYEwgVBnqS5B3lL1IlKenuOHTB4dmFbMvYH7gN7HTOk"
diff --git a/zones/inspect.monster.zone b/zones/inspect.monster.zone
index 3c98b1b..66fde88 100644
--- a/zones/inspect.monster.zone
+++ b/zones/inspect.monster.zone
@@ -1,10 +1,26 @@
-; Zone file for inspect.monster
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/inspect.monster.zone
 $ORIGIN inspect.monster.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.inspect.monster. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	inspect.monster
-	300	IN	MX	10	inspect.monster
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	inspect.monster.
+@	300	IN	MX	10	inspect.monster.
diff --git a/zones/inspect.pics.zone b/zones/inspect.pics.zone
index ac2ad6f..297ece8 100644
--- a/zones/inspect.pics.zone
+++ b/zones/inspect.pics.zone
@@ -1,18 +1,32 @@
-; Zone file for inspect.pics
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/inspect.pics.zone
 $ORIGIN inspect.pics.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.inspect.pics. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
+
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
 l	300	IN	A	127.0.0.1
 *.l	300	IN	A	127.0.0.1
-	300	IN	A	74.91.22.232
-*	300	IN	CNAME	inspect.pics
-	300	IN	MX	10	inspect.pics
+@	300	IN	A	74.91.22.232
+*	300	IN	CNAME	inspect.pics.
+@	300	IN	MX	10	inspect.pics.
 _acme-challenge	300	IN	TXT	"O76KUDoUq834H7foiWV2VXVO-XWWAx2mGm1Gt3YJtvQ"
 _acme-challenge	300	IN	TXT	"0QRoK7IMPLfLffpv8aH8afyw6f9ssDb9NPbWJSJ66q8"
 _acme-challenge.admin	300	IN	TXT	"i5VYntrsr97R142m7Xj7FJR4huFX1KGlQPgnQjHEeTk"
-; Explicit CNAMEs added to fix RFC 4592 empty-non-terminal cases
-; (parent name has _acme-challenge children, so wildcard would skip it)
-admin	300	IN	CNAME	inspect.pics
+admin	300	IN	CNAME	inspect.pics.
diff --git a/zones/inspect.systems.zone b/zones/inspect.systems.zone
index 1d8a259..802f5cc 100644
--- a/zones/inspect.systems.zone
+++ b/zones/inspect.systems.zone
@@ -1,11 +1,27 @@
-; Zone file for inspect.systems
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/inspect.systems.zone
 $ORIGIN inspect.systems.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.inspect.systems. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.232
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.232
 properties	300	IN	A	108.61.23.129
 nielsen-inspections	300	IN	A	74.91.22.232
 vh.l	300	IN	A	127.0.0.1
@@ -16,12 +32,12 @@ vh	300	IN	A	74.91.22.232
 *.vh	300	IN	A	74.91.22.232
 maps	300	IN	A	74.91.22.232
 *.pitch.l	300	IN	A	127.0.0.1
-api.properties	300	IN	CNAME	properties.inspect.systems
-*.maps	300	IN	CNAME	maps.inspect.systems
-api	300	IN	CNAME	inspect.systems
-crm	300	IN	CNAME	inspect.systems
-*.crm	300	IN	CNAME	crm.inspect.systems
-	300	IN	MX	10	inspect.systems
+api.properties	300	IN	CNAME	properties.inspect.systems.
+*.maps	300	IN	CNAME	maps.inspect.systems.
+api	300	IN	CNAME	inspect.systems.
+crm	300	IN	CNAME	inspect.systems.
+*.crm	300	IN	CNAME	crm.inspect.systems.
+@	300	IN	MX	10	inspect.systems.
 _acme-challenge.operate	300	IN	TXT	"OSIKGstLTQz9frXXRU-3-OvTlU8dLoWtcegc_CdGCbc"
 _acme-challenge.operate	300	IN	TXT	"WNomXhVF1Ymh5NrLhJ10vp2i9o8ia6KWHt_xIRlp4as"
 _acme-challenge	300	IN	TXT	"FiVckyB6dI47M5w-gljo2mK0P2xR3ydjJx0CtC4lHUM"
@@ -30,8 +46,8 @@ _acme-challenge	300	IN	TXT	"1qLCDrKw1nNkCQ5NWSZlkF2yU85qiBday89IaAd_QdA"
 _acme-challenge.rentcast	300	IN	TXT	"4QPeaV-7P8XwGKSARcgqil1IwWwnLvSO5t3RM0wnN8I"
 _acme-challenge.properties	300	IN	TXT	"2vdt3jDH9cnVlTURGi32dpT0fTMJxGLFTif8da_HwFo"
 google-site-verification	300	IN	TXT	"_EJ1YRy_aoJLEGhHK8QYyUgcOudM7TgQHiqr"
-	300	IN	TXT	"google-site-verification=_EJ1YRy_aoJLEGhHK8QYyUgcOudM7TgQHiqry87x7Hk"
+@	300	IN	TXT	"google-site-verification=_EJ1YRy_aoJLEGhHK8QYyUgcOudM7TgQHiqry87x7Hk"
 _acme-challenge.hsp.l	300	IN	TXT	"85HMpvUyNzHQtvy9Z7vUE7Sfpe96kVYbkqeazdPEiGQ"
 _acme-challenge.auth.l	300	IN	TXT	"1I0ITcegP5yRd6dwevuw00WWyjSrGu7NQq2pxOnQhLY"
 _acme-challenge.api.properties	300	IN	TXT	"8LS8rK4pP-dJ7lVtXjXRWBEvPPBxC2CwEZ5SWuF-6Lw"
-_acme-challenge.mail.hsp.l	300	IN	TXT	"grD5BUnt_VxhvY200OOPZQQzZAZj06GtUK5kSap0jGQ"
\ No newline at end of file
+_acme-challenge.mail.hsp.l	300	IN	TXT	"grD5BUnt_VxhvY200OOPZQQzZAZj06GtUK5kSap0jGQ"
diff --git a/zones/inspects.homes.zone b/zones/inspects.homes.zone
index 56c965b..bb8308c 100644
--- a/zones/inspects.homes.zone
+++ b/zones/inspects.homes.zone
@@ -1,13 +1,29 @@
-; Zone file for inspects.homes
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/inspects.homes.zone
 $ORIGIN inspects.homes.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.inspects.homes. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	inspects.homes
-	300	IN	MX	10	inspects.homes
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	inspects.homes.
+@	300	IN	MX	10	inspects.homes.
 _acme-challenge	300	IN	TXT	"7mrEVPlDNmCMXoxghHwuNrj3FHPavpiPnMEcTpfoH_0"
 _acme-challenge	300	IN	TXT	"Y5Og2bzxdWDvvGLQlkXXpLy2xKIJMuXV3WTpBzmhHiY"
-_acme-challenge	300	IN	TXT	"FbCMdIZpiZlR4CBqBMkGuTll6qwJFE-BwcFJSQHrkcE"
\ No newline at end of file
+_acme-challenge	300	IN	TXT	"FbCMdIZpiZlR4CBqBMkGuTll6qwJFE-BwcFJSQHrkcE"
diff --git a/zones/jobsite.homes.zone b/zones/jobsite.homes.zone
index d32c88d..97d9eb2 100644
--- a/zones/jobsite.homes.zone
+++ b/zones/jobsite.homes.zone
@@ -1,10 +1,26 @@
-; Zone file for jobsite.homes
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/jobsite.homes.zone
 $ORIGIN jobsite.homes.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.jobsite.homes. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	108.61.23.129
-*	300	IN	CNAME	jobsite.homes
-	300	IN	MX	10	jobsite.homes
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	108.61.23.129
+*	300	IN	CNAME	jobsite.homes.
+@	300	IN	MX	10	jobsite.homes.
diff --git a/zones/kg7q.cc.zone b/zones/kg7q.cc.zone
index 35a3ae4..6cda9fb 100644
--- a/zones/kg7q.cc.zone
+++ b/zones/kg7q.cc.zone
@@ -1,12 +1,28 @@
-; Zone file for kg7q.cc
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/kg7q.cc.zone
 $ORIGIN kg7q.cc.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.kg7q.cc. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	64.177.113.31
-*.l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net
-l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net
-*	300	IN	CNAME	kg7q.cc
-	300	IN	MX	10	mail.supported.systems
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	64.177.113.31
+*.l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net.
+l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net.
+*	300	IN	CNAME	kg7q.cc.
+@	300	IN	MX	10	mail.supported.systems.
diff --git a/zones/log.doctor.zone b/zones/log.doctor.zone
index ee9af7b..376aa92 100644
--- a/zones/log.doctor.zone
+++ b/zones/log.doctor.zone
@@ -1,16 +1,30 @@
-; Zone file for log.doctor
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/log.doctor.zone
 $ORIGIN log.doctor.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.log.doctor. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.226
-*	300	IN	CNAME	log.doctor
-	300	IN	MX	10	log.doctor
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.226
+*	300	IN	CNAME	log.doctor.
+@	300	IN	MX	10	log.doctor.
 _acme-challenge.app	300	IN	TXT	"y2ZR60rA40x7LtMubTbAZNNubTCIHm36_FT0dTZ6e9E"
 _acme-challenge.docs	300	IN	TXT	"5lVC4dW_6dd8ir0eNION32rSBVTl1WXL69QRzaiJ8ds"
-; Explicit CNAMEs added to fix RFC 4592 empty-non-terminal cases
-; (parent name has _acme-challenge children, so wildcard would skip it)
-app	300	IN	CNAME	log.doctor
-docs	300	IN	CNAME	log.doctor
+app	300	IN	CNAME	log.doctor.
+docs	300	IN	CNAME	log.doctor.
diff --git a/zones/lukascrockett.com.zone b/zones/lukascrockett.com.zone
index aff9828..4048a05 100644
--- a/zones/lukascrockett.com.zone
+++ b/zones/lukascrockett.com.zone
@@ -1,14 +1,30 @@
-; Zone file for lukascrockett.com
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/lukascrockett.com.zone
 $ORIGIN lukascrockett.com.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.lukascrockett.com. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
 mail	3600	IN	A	66.42.75.247
-*	300	IN	CNAME	lukascrockett.com
-	300	IN	MX	10	mail.supported.systems
+*	300	IN	CNAME	lukascrockett.com.
+@	300	IN	MX	10	mail.supported.systems.
 _acme-challenge	300	IN	TXT	"YrLNcgbxEOPdEE8s-Ba4w0iHVVSWTX3uQQQHk8Xrgwo"
 _acme-challenge	300	IN	TXT	"Gq03noaghtCkdjgQQUPf6CacZaYqFuOMLJLyws9wibM"
 _acme-challenge	300	IN	TXT	"smQymDPT3Ly1knxl9gbe0X6fq2IW95r6j03SL3z-C98"
@@ -19,4 +35,4 @@ _acme-challenge	300	IN	TXT	"VSvPcX1tAvUhs7hMrvjJEaF-Agjt0GeA_EQCyB6MFEQ"
 _acme-challenge	300	IN	TXT	"quP3aX7vxqc37_VL7y9vHBseSM_OaALkGQYqWFDKma0"
 _acme-challenge	300	IN	TXT	"6yXwyJweM1iTDLH-ONYIG1nudIM2qCtcOldtAcWmrmI"
 _acme-challenge	300	IN	TXT	"fji0kvYStzx22d3UDTS74EnuJGLQtBlexrsQt4qiV_4"
-_acme-challenge	300	IN	TXT	"uTYNsXtezmVIZnPqHMjMYi-3zYPzCVV8uRYoZsREJxk"
\ No newline at end of file
+_acme-challenge	300	IN	TXT	"uTYNsXtezmVIZnPqHMjMYi-3zYPzCVV8uRYoZsREJxk"
diff --git a/zones/malloys.us.zone b/zones/malloys.us.zone
index e794eda..c86ae6b 100644
--- a/zones/malloys.us.zone
+++ b/zones/malloys.us.zone
@@ -1,22 +1,38 @@
-; Zone file for malloys.us
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/malloys.us.zone
 $ORIGIN malloys.us.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.malloys.us. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-dev.mary	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net
-*	300	IN	CNAME	malloys.us
-*.dev.mary	300	IN	CNAME	dev.mary.malloys.us
-vault	300	IN	CNAME	idahomuellers.fortiddns.com
-	300	IN	MX	10	smtp.google.com
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+dev.mary	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net.
+*	300	IN	CNAME	malloys.us.
+*.dev.mary	300	IN	CNAME	dev.mary.malloys.us.
+vault	300	IN	CNAME	idahomuellers.fortiddns.com.
+@	300	IN	MX	10	smtp.google.com.
 dkim._domainkey	300	IN	TXT	"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAioX3DstYBuThEEyFs/o7m4HqsaImxMJRC7o12FvX90btr7c3RXkvRzY9sawhW3O0XmhfaJfZ/Gho0ng2RwKLEdYQcnoSJaYwV+3ERvdDBwlDgBNgUs9ODmP10HELpsgRg+sNoBClZNXXuT+pkuQhRpvVz9KQWRSsHvhh5ZUCTmx4vdC9WskvfqWxgC39qScEBLylqoCYjkzIk+ByYc8X9rSUzKZ2HaHMLTlzei1k16QiLgwPHa8QRPDWsH8joIg8XW3SiLDRrwfub+lZRe5d7V+13HO76k9LXMNzG4kSAwxvDMWnfD2iki3x7tQ/CFfdcsLUDfbuRy7d3JKwMZDsbQIDAQAB"
 _acme-challenge.cp	300	IN	TXT	"I8y77h78LeuG7H8CpyELFfgHjfWBcd0VRkPAYboV5Mg"
 _acme-challenge.cp-sandbox	300	IN	TXT	"LUNk008FKra7ifgL61DV681kmo4wThRJb6zG4t1mDww"
 _acme-challenge.cp	300	IN	TXT	"d3iE6aJJRzKE3iFajLg_67oYeskj_XLDNuxKt6BuG3c"
-	300	IN	TXT	"v=spf1 include:_spf.google.com ~all"
-	300	IN	TXT	"v=DMARC1; p=none; rua=mailto:dmarc@malloys.us"
+@	300	IN	TXT	"v=spf1 include:_spf.google.com ~all"
+@	300	IN	TXT	"v=DMARC1; p=none; rua=mailto:dmarc@malloys.us"
 _acme-challenge	300	IN	TXT	"dFdOw5R4dkuNvN0SokI5v5cQbIihwCyiHu_gIxzbAo0"
 _acme-challenge	300	IN	TXT	"2ErkGT83BzfrsCKFhutetQMIsnzIwcvTKJ8kkcfcJ8k"
 _acme-challenge	300	IN	TXT	"UEsEmtEazgpBNfB_qbCNqG1r9rKWUvzyoCQHpTvYPQA"
@@ -38,9 +54,7 @@ _acme-challenge	300	IN	TXT	"hPz_OIZGc2qyHrNMGkPCXDf4ML4bv67P_ojmb-ed6gM"
 _acme-challenge	300	IN	TXT	"mzrirf7ykU_V_6mh38Q664h_yg3AEVA88tQRE7YGOUc"
 _acme-challenge	300	IN	TXT	"v4oJppz3N-D9IEBw0faQ54pg7WsLmDNua7bVgQWVmpw"
 _acme-challenge	300	IN	TXT	"OlN30ETZq9etulzl9lOMTDvWQ4Frpq2NlyGOx5kpB_I"
-	300	IN	TXT	"openai-domain-verification=dv-pa82Ps1fOTq50Ad2crkhWWTv"
-; Explicit CNAMEs added to fix RFC 4592 empty-non-terminal cases
-; (parent name has _acme-challenge children, so wildcard would skip it)
-cp	300	IN	CNAME	malloys.us
-cp-sandbox	300	IN	CNAME	malloys.us
-mary	300	IN	CNAME	malloys.us
+@	300	IN	TXT	"openai-domain-verification=dv-pa82Ps1fOTq50Ad2crkhWWTv"
+cp	300	IN	CNAME	malloys.us.
+cp-sandbox	300	IN	CNAME	malloys.us.
+mary	300	IN	CNAME	malloys.us.
diff --git a/zones/mcp.website.zone b/zones/mcp.website.zone
index 790f0d0..d68bfe5 100644
--- a/zones/mcp.website.zone
+++ b/zones/mcp.website.zone
@@ -1,10 +1,26 @@
-; Zone file for mcp.website
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/mcp.website.zone
 $ORIGIN mcp.website.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.mcp.website. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	64.177.113.31
-*	300	IN	CNAME	mcp.website
-	300	IN	MX	10	mcp.website
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	64.177.113.31
+*	300	IN	CNAME	mcp.website.
+@	300	IN	MX	10	mcp.website.
diff --git a/zones/mcpdash.wtf.zone b/zones/mcpdash.wtf.zone
index db5bc08..2263c2f 100644
--- a/zones/mcpdash.wtf.zone
+++ b/zones/mcpdash.wtf.zone
@@ -1,10 +1,26 @@
-; Zone file for mcpdash.wtf
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/mcpdash.wtf.zone
 $ORIGIN mcpdash.wtf.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.mcpdash.wtf. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	108.61.23.129
-*	300	IN	CNAME	mcpdash.wtf
-	300	IN	MX	10	mcpdash.wtf
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	108.61.23.129
+*	300	IN	CNAME	mcpdash.wtf.
+@	300	IN	MX	10	mcpdash.wtf.
diff --git a/zones/myhood.us.zone b/zones/myhood.us.zone
index 45cd748..309cbd6 100644
--- a/zones/myhood.us.zone
+++ b/zones/myhood.us.zone
@@ -1,14 +1,30 @@
-; Zone file for myhood.us
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/myhood.us.zone
 $ORIGIN myhood.us.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.myhood.us. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	myhood.us
-autoconfig	300	IN	CNAME	mail.supported.systems
-mail.supported.systems	300	IN	MX	10	myhood.us
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	myhood.us.
+autoconfig	300	IN	CNAME	mail.supported.systems.
+mail.supported.systems	300	IN	MX	10	myhood.us.
 myhood.us_report_dmarc.mail	300	IN	TXT	"v=DMARC1;"
 _dmarc	300	IN	TXT	"v=DMARC1; p=reject; rua=mailto:reports@mrpickett.com; adkim=s; aspf=s;"
 _acme-challenge	300	IN	TXT	"uKPYK58a44s0kWpnppooML4E4MkptkgVGqvaUK5eWXw"
@@ -26,4 +42,4 @@ _acme-challenge	300	IN	TXT	"dkzMydDeiX6a07LbM1O-KCkyTvNoEjMsH9SJETKygBE"
 _acme-challenge	300	IN	TXT	"36vAmVKS_ALuL2kB1KlVMvz44WN2LKCb0tBmA43gXSo"
 _acme-challenge	300	IN	TXT	"BYICEu3hp5veDk1eCKQsrso36eq4uv-zGpqMszlWT6o"
 _acme-challenge	300	IN	TXT	"goItf43E0Yi_uZ6E-S0DxyxoA1v5o9FdHR6Tk9-avZ0"
-_acme-challenge	300	IN	TXT	"4_XAQyLYKQNDV1Bs2CPHQt3FU4uo6g_rrwb5zuyMyNw"
\ No newline at end of file
+_acme-challenge	300	IN	TXT	"4_XAQyLYKQNDV1Bs2CPHQt3FU4uo6g_rrwb5zuyMyNw"
diff --git a/zones/nielsen-inspections.com.zone b/zones/nielsen-inspections.com.zone
index f39fb8c..b1bc80c 100644
--- a/zones/nielsen-inspections.com.zone
+++ b/zones/nielsen-inspections.com.zone
@@ -1,23 +1,39 @@
-; Zone file for nielsen-inspections.com
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/nielsen-inspections.com.zone
 $ORIGIN nielsen-inspections.com.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.nielsen-inspections.com. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
+
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
 *	300	IN	A	74.91.22.234
-	300	IN	A	74.91.22.234
+@	300	IN	A	74.91.22.234
 new	300	IN	A	74.91.22.232
 74.91.22.232	300	IN	A	74.91.22.232
 l	300	IN	A	127.0.0.1
 *.l	300	IN	A	127.0.0.1
-supabase	300	IN	CNAME	supabase.supported.systems
-quote	300	IN	CNAME	nielsen-inspections.inspect.systems
-docs	300	IN	CNAME	nielsen-inspections.inspect.systems
-docs-sandbox	300	IN	CNAME	nielsen-inspections.inspect.systems
-	300	IN	MX	10	mail.supported.systems
+supabase	300	IN	CNAME	supabase.supported.systems.
+quote	300	IN	CNAME	nielsen-inspections.inspect.systems.
+docs	300	IN	CNAME	nielsen-inspections.inspect.systems.
+docs-sandbox	300	IN	CNAME	nielsen-inspections.inspect.systems.
+@	300	IN	MX	10	mail.supported.systems.
 nielsen-inspections.com_report._dmarc.mail	3600	IN	TXT	"v=DMARC1"
-	300	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
+@	300	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
 dkim._domainkey	300	IN	TXT	"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuGPt3zH0RxxDUW1Wg+3FOKIYNQy5vo/hvbPB/U6O7hh5K/SnQ2MDPfnL3B+Ur3kKmYFcSTdVMotr9Ds7wRJWFv49oK4f4VKxfoBD8Sh9GrJDNDM+g86h8M1v3cWKLdeRa+UczJDLRb9wwW8eRR17OQafqGupN0ZbsazbZwTrC5z/RZlLBtEMsIceWwHPhR+H3Bl9rH2t1RQSjbD2A9fM5EPXeVvzn9SwDpxgfMRfs7/k/prPASxW0/8Bun3k2BOzOjP/H4v509xTJOn/6S5eC2QJ47hw5XsjOu1j9Fy2YqUkgDpcrqLiS5K/7E+BSWURitfuxAamv+vkTfrbU3D0lQIDAQAB"
 _acme-challenge.new	300	IN	TXT	"-hHWyBLh_3qyIy1gYFSifjgOAbmN2t3OU2I_232rVNU"
 _acme-challenge.new	300	IN	TXT	"WQbACLatgQG_0Z3IrbcMMjzOleV5El5NUp8gTJuHd0A"
@@ -42,9 +58,7 @@ _acme-challenge	300	IN	TXT	"_OarPKPxYMpsvT_VuAKVkJoxP1vQmqMMRESOwpPflbg"
 _acme-challenge	300	IN	TXT	"06at-8AT6CKT6Cbn5JEfASqOyiqx2T-PfvYlg4O86Bo"
 _acme-challenge	300	IN	TXT	"8YYbiZ4dEbfK0KKrVWl81ZCdamED1a9b_3we2JEl-rE"
 _acme-challenge.files	300	IN	TXT	"nckNo7UBhAFgevwMvQ85niQIiXuU37FoLK3XVECZzfk"
-; Explicit CNAMEs added to fix RFC 4592 empty-non-terminal cases
-; (parent name has _acme-challenge children, so wildcard would skip it)
-calendar	300	IN	CNAME	nielsen-inspections.com
-cw	300	IN	CNAME	nielsen-inspections.com
-files	300	IN	CNAME	nielsen-inspections.com
-v2-calendar	300	IN	CNAME	nielsen-inspections.com
+calendar	300	IN	CNAME	nielsen-inspections.com.
+cw	300	IN	CNAME	nielsen-inspections.com.
+files	300	IN	CNAME	nielsen-inspections.com.
+v2-calendar	300	IN	CNAME	nielsen-inspections.com.
diff --git a/zones/nielsens.world.zone b/zones/nielsens.world.zone
index b0b6ee5..e630f32 100644
--- a/zones/nielsens.world.zone
+++ b/zones/nielsens.world.zone
@@ -1,13 +1,29 @@
-; Zone file for nielsens.world
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/nielsens.world.zone
 $ORIGIN nielsens.world.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.nielsens.world. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	nielsens.world
-	300	IN	MX	10	nielsens.world
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	nielsens.world.
+@	300	IN	MX	10	nielsens.world.
 _acme-challenge	300	IN	TXT	"yp-IarvtiSb7qhW1xT6l3V7vZePbvgRmPJwYUKpT1uM"
 _acme-challenge	300	IN	TXT	"P0qX-6q0E2i8boMN2k2P9QEFL8no62uJyQXKU6cd748"
 _acme-challenge	300	IN	TXT	"Rp394t0XdkqnnJqfBQpGQwKpFAbQn9-XJAd1V_rVoyg"
@@ -22,4 +38,4 @@ _acme-challenge	300	IN	TXT	"5N-B9TqOnm7ax5s_MLb2eYkEJHu16pR_5XbyCc4Ws3M"
 _acme-challenge	300	IN	TXT	"cQD7ne1AEfylbTLsz0cu4WjzZTYYs4Sf2-Co5_xXyFc"
 _acme-challenge	300	IN	TXT	"-qb5Ano9xU1Z1aAtZ16kInYKpItqjX0fQwm2rRLHXwg"
 _acme-challenge	300	IN	TXT	"t8qVdInrTstes_A-Cub-pVyMkk7PivPxvtNE59HTMNM"
-_acme-challenge	300	IN	TXT	"CcZ2OuKYLR80GT1zf8CiHvkfwVz8QJras98kMQIasKw"
\ No newline at end of file
+_acme-challenge	300	IN	TXT	"CcZ2OuKYLR80GT1zf8CiHvkfwVz8QJras98kMQIasKw"
diff --git a/zones/ourjob.site.zone b/zones/ourjob.site.zone
index 293e6bb..a762853 100644
--- a/zones/ourjob.site.zone
+++ b/zones/ourjob.site.zone
@@ -1,12 +1,28 @@
-; Zone file for ourjob.site
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/ourjob.site.zone
 $ORIGIN ourjob.site.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.ourjob.site. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	108.61.23.129
-l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net
-*.l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net
-*	300	IN	CNAME	ourjob.site
-	300	IN	MX	10	ourjob.site
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	108.61.23.129
+l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net.
+*.l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net.
+*	300	IN	CNAME	ourjob.site.
+@	300	IN	MX	10	ourjob.site.
diff --git a/zones/paigemalloy.com.zone b/zones/paigemalloy.com.zone
index 6b6c0ef..416c7bd 100644
--- a/zones/paigemalloy.com.zone
+++ b/zones/paigemalloy.com.zone
@@ -1,13 +1,29 @@
-; Zone file for paigemalloy.com
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/paigemalloy.com.zone
 $ORIGIN paigemalloy.com.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.paigemalloy.com. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	paigemalloy.com
-	300	IN	MX	10	paigemalloy.com
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	paigemalloy.com.
+@	300	IN	MX	10	paigemalloy.com.
 _acme-challenge	300	IN	TXT	"YLoFC0o_ZDvk0Fz-pMJHpMPDz5IHNy_CCZq9gY0xcXk"
 _acme-challenge	300	IN	TXT	"HKi0Whd31hGZjayLUZUE86_PF8RPvy-yghxbVdyoVoQ"
 _acme-challenge	300	IN	TXT	"l9F-TnZEcPXu63A2IsQkJxuqsN5QaovR21uGZhCqh1U"
@@ -19,4 +35,4 @@ _acme-challenge	300	IN	TXT	"Dr7s_BX6fHwmd2H6EbfnBWqC7D2enV3Kqp6r9gXiVSE"
 _acme-challenge	300	IN	TXT	"BFOaEgEwoqmBLePqn2uEgXmhFJyFvik9Uw02kJcX4C4"
 _acme-challenge	300	IN	TXT	"8K3qpw5zZ1M2GbCxWlgYdQxAVoZHcQzg-2rK_e7zRDQ"
 _acme-challenge	300	IN	TXT	"UKnDm8Nj10v1UtHnPd4KtdewGkTBKgKNxH6ZTAg0WLM"
-_acme-challenge	300	IN	TXT	"RnPOmkbwqpfZx0dZ8bC6u6wbpRJa5gIYup5jespMFfE"
\ No newline at end of file
+_acme-challenge	300	IN	TXT	"RnPOmkbwqpfZx0dZ8bC6u6wbpRJa5gIYup5jespMFfE"
diff --git a/zones/paythatway.com.zone b/zones/paythatway.com.zone
index 0e8d35c..95b0e19 100644
--- a/zones/paythatway.com.zone
+++ b/zones/paythatway.com.zone
@@ -1,10 +1,26 @@
-; Zone file for paythatway.com
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/paythatway.com.zone
 $ORIGIN paythatway.com.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.paythatway.com. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	paythatway.com
-	300	IN	MX	10	paythatway.com
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	paythatway.com.
+@	300	IN	MX	10	paythatway.com.
diff --git a/zones/powdercoatedcabinents.com.zone b/zones/powdercoatedcabinents.com.zone
index 1f251e8..e071fd6 100644
--- a/zones/powdercoatedcabinents.com.zone
+++ b/zones/powdercoatedcabinents.com.zone
@@ -1,10 +1,26 @@
-; Zone file for powdercoatedcabinents.com
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/powdercoatedcabinents.com.zone
 $ORIGIN powdercoatedcabinents.com.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.powdercoatedcabinents.com. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	powdercoatedcabinents.com
-	300	IN	MX	10	powdercoatedcabinents.com
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	powdercoatedcabinents.com.
+@	300	IN	MX	10	powdercoatedcabinents.com.
diff --git a/zones/powdercoatedcabinet.com.zone b/zones/powdercoatedcabinet.com.zone
index 9473d19..b608607 100644
--- a/zones/powdercoatedcabinet.com.zone
+++ b/zones/powdercoatedcabinet.com.zone
@@ -1,10 +1,26 @@
-; Zone file for powdercoatedcabinet.com
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/powdercoatedcabinet.com.zone
 $ORIGIN powdercoatedcabinet.com.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.powdercoatedcabinet.com. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	powdercoatedcabinet.com
-	300	IN	MX	10	powdercoatedcabinet.com
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	powdercoatedcabinet.com.
+@	300	IN	MX	10	powdercoatedcabinet.com.
diff --git a/zones/powdercotedcabinets.com.zone b/zones/powdercotedcabinets.com.zone
index 7987f5e..4256093 100644
--- a/zones/powdercotedcabinets.com.zone
+++ b/zones/powdercotedcabinets.com.zone
@@ -1,10 +1,26 @@
-; Zone file for powdercotedcabinets.com
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/powdercotedcabinets.com.zone
 $ORIGIN powdercotedcabinets.com.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.powdercotedcabinets.com. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	powdercotedcabinets.com
-	300	IN	MX	10	powdercotedcabinets.com
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	powdercotedcabinets.com.
+@	300	IN	MX	10	powdercotedcabinets.com.
diff --git a/zones/prezhub.com.zone b/zones/prezhub.com.zone
index 818a9dc..c69423b 100644
--- a/zones/prezhub.com.zone
+++ b/zones/prezhub.com.zone
@@ -1,11 +1,27 @@
-; Zone file for prezhub.com
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/prezhub.com.zone
 $ORIGIN prezhub.com.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.prezhub.com. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	149.248.39.194
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	149.248.39.194
 dev	300	IN	A	45.77.214.114
 cloud	3600	IN	A	104.156.237.74
 dev2	300	IN	A	149.248.33.94
@@ -15,5 +31,5 @@ hspres	3600	IN	A	172.30.10.11
 hspres-dev	3600	IN	A	172.30.30.10
 upgrade	3600	IN	A	45.32.230.148
 python3	3600	IN	A	66.42.65.192
-*	300	IN	CNAME	prezhub.com
-	300	IN	MX	10	prezhub.com
\ No newline at end of file
+*	300	IN	CNAME	prezhub.com.
+@	300	IN	MX	10	prezhub.com.
diff --git a/zones/reviewr.guru.zone b/zones/reviewr.guru.zone
index 7db1911..a6c205c 100644
--- a/zones/reviewr.guru.zone
+++ b/zones/reviewr.guru.zone
@@ -1,12 +1,28 @@
-; Zone file for reviewr.guru
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/reviewr.guru.zone
 $ORIGIN reviewr.guru.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.reviewr.guru. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	reviewr.guru
-	300	IN	MX	10	reviewr.guru
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	reviewr.guru.
+@	300	IN	MX	10	reviewr.guru.
 _acme-challenge	300	IN	TXT	"fGfh9Hq2rjOu_QM6xeU19akab6kBTU2d1hWVrJLyowY"
-_acme-challenge	300	IN	TXT	"Wpjy1LvjA94-LpIsp5PpyrXK-ZVQ-zlAoIhu2XR2gAg"
\ No newline at end of file
+_acme-challenge	300	IN	TXT	"Wpjy1LvjA94-LpIsp5PpyrXK-ZVQ-zlAoIhu2XR2gAg"
diff --git a/zones/rsvp-for.de.zone b/zones/rsvp-for.de.zone
index 93a89c8..0d2bf51 100644
--- a/zones/rsvp-for.de.zone
+++ b/zones/rsvp-for.de.zone
@@ -1,10 +1,26 @@
-; Zone file for rsvp-for.de
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/rsvp-for.de.zone
 $ORIGIN rsvp-for.de.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.rsvp-for.de. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	rsvp-for.de
-	300	IN	MX	10	rsvp-for.de
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	rsvp-for.de.
+@	300	IN	MX	10	rsvp-for.de.
diff --git a/zones/ryanmalloy.com.zone b/zones/ryanmalloy.com.zone
index 5681250..2b24704 100644
--- a/zones/ryanmalloy.com.zone
+++ b/zones/ryanmalloy.com.zone
@@ -1,19 +1,33 @@
-; Zone file for ryanmalloy.com
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/ryanmalloy.com.zone
 $ORIGIN ryanmalloy.com.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.ryanmalloy.com. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	NS	ns.supported.systems
-	300	IN	A	108.61.23.129
-l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net
-*.l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net
-*	300	IN	CNAME	ryanmalloy.com
-	300	IN	MX	10	mail.supported.systems
-	300	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	NS	ns.supported.systems.
+@	300	IN	A	108.61.23.129
+l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net.
+*.l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net.
+*	300	IN	CNAME	ryanmalloy.com.
+@	300	IN	MX	10	mail.supported.systems.
+@	300	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
 _dmarc	3600	IN	TXT	"v=DMARC1; p=quarantine; rua=mailto:reports@ryanmalloy.com; adkim=s; aspf=s;"
 _acme-challenge.c4ai	300	IN	TXT	"sjdm_4JFJfjMQL2ZFb6k-S99gKOnxloIlDrAj15uNkQ"
-; Explicit CNAMEs added to fix RFC 4592 empty-non-terminal cases
-; (parent name has _acme-challenge children, so wildcard would skip it)
-c4ai	300	IN	CNAME	ryanmalloy.com
+c4ai	300	IN	CNAME	ryanmalloy.com.
diff --git a/zones/screencast.systems.zone b/zones/screencast.systems.zone
index 16b0f3a..78feb29 100644
--- a/zones/screencast.systems.zone
+++ b/zones/screencast.systems.zone
@@ -1,10 +1,26 @@
-; Zone file for screencast.systems
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/screencast.systems.zone
 $ORIGIN screencast.systems.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.screencast.systems. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	screencast.systems
-	300	IN	MX	10	screencast.systems
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	screencast.systems.
+@	300	IN	MX	10	screencast.systems.
diff --git a/zones/septic.report.zone b/zones/septic.report.zone
index c9cc458..45c5ab1 100644
--- a/zones/septic.report.zone
+++ b/zones/septic.report.zone
@@ -1,14 +1,30 @@
-; Zone file for septic.report
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/septic.report.zone
 $ORIGIN septic.report.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.septic.report. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	108.61.23.129
-*.l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net
-l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net
-*	300	IN	CNAME	septic.report
-permits	300	IN	CNAME	docker-2.supportedsystems.net
-*.permits	300	IN	CNAME	permits.septic.report
-	300	IN	MX	10	septic.report
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	108.61.23.129
+*.l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net.
+l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net.
+*	300	IN	CNAME	septic.report.
+permits	300	IN	CNAME	docker-2.supportedsystems.net.
+*.permits	300	IN	CNAME	permits.septic.report.
+@	300	IN	MX	10	septic.report.
diff --git a/zones/sidejob.pro.zone b/zones/sidejob.pro.zone
index e843b58..9276706 100644
--- a/zones/sidejob.pro.zone
+++ b/zones/sidejob.pro.zone
@@ -1,18 +1,32 @@
-; Zone file for sidejob.pro
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/sidejob.pro.zone
 $ORIGIN sidejob.pro.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.sidejob.pro. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	108.61.23.129
-*.l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net
-l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net
-*	300	IN	CNAME	sidejob.pro
-	300	IN	MX	10	sidejob.pro
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	108.61.23.129
+*.l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net.
+l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net.
+*	300	IN	CNAME	sidejob.pro.
+@	300	IN	MX	10	sidejob.pro.
 _acme-challenge.api	300	IN	TXT	"a1zkQ7ukvloDCOuB5kCsxC1TWH2rRXKCCI88GJrwV84"
 _acme-challenge.api	300	IN	TXT	"UIKc6hzCSLphH1kQtdGMspvWKcG-k4hXcPOOV6HrydA"
 _acme-challenge.api	300	IN	TXT	"GySOUk0DnGhgDKXDgUM-ggQudeENlQIi6jBPtb2O0EE"
-; Explicit CNAMEs added to fix RFC 4592 empty-non-terminal cases
-; (parent name has _acme-challenge children, so wildcard would skip it)
-api	300	IN	CNAME	sidejob.pro
+api	300	IN	CNAME	sidejob.pro.
diff --git a/zones/spencernewbolt.com.zone b/zones/spencernewbolt.com.zone
index 07b5b2b..7115828 100644
--- a/zones/spencernewbolt.com.zone
+++ b/zones/spencernewbolt.com.zone
@@ -1,13 +1,29 @@
-; Zone file for spencernewbolt.com
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/spencernewbolt.com.zone
 $ORIGIN spencernewbolt.com.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.spencernewbolt.com. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	spencernewbolt.com
-	300	IN	MX	10	spencernewbolt.com
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	spencernewbolt.com.
+@	300	IN	MX	10	spencernewbolt.com.
 _acme-challenge	300	IN	TXT	"7LRHziqmBhlugdqQkYZXApqUvxiBge0778ytQD1tpTE"
 _acme-challenge	300	IN	TXT	"jLCV5ppfiEtaQgi1gJhrz3wjJxToz-K3rvipV1V15VA"
 _acme-challenge	300	IN	TXT	"xAopkrs3dtpclwG4xsFxJel0bonXEaik4AO2V45H7CE"
@@ -19,4 +35,4 @@ _acme-challenge	300	IN	TXT	"i73WUBm7JxVmoIMS4U-b0MIKIYsM0O-XVCQWOj2dJrU"
 _acme-challenge	300	IN	TXT	"HZ-VtFzV2KqB2o4cIcxI2Z-Hg2f39I1YtuhsKIreEZY"
 _acme-challenge	300	IN	TXT	"OZvWikr-Q0gDjAW0o5Ka-vDKO7DwLPjLsn_SiKx3rXc"
 _acme-challenge	300	IN	TXT	"YbWH161Cf4IWHhjeBg0E0iZsLZiIaxABS-dnz9KhCYE"
-_acme-challenge	300	IN	TXT	"-2-QqVRhx86FWbMlO-3e3Dasv_hadKc4sbOpX_9V_eg"
\ No newline at end of file
+_acme-challenge	300	IN	TXT	"-2-QqVRhx86FWbMlO-3e3Dasv_hadKc4sbOpX_9V_eg"
diff --git a/zones/supported.systems.zone b/zones/supported.systems.zone
index 3a874b9..d7e5111 100644
--- a/zones/supported.systems.zone
+++ b/zones/supported.systems.zone
@@ -1,20 +1,33 @@
-; Zone file for supported.systems
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/supported.systems.zone
 $ORIGIN supported.systems.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.supported.systems. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.he.net
-	300	IN	NS	ns2.he.net
-	300	IN	NS	ns3.he.net
-	300	IN	NS	ns4.he.net
-	300	IN	NS	ns5.he.net
-	300	IN	A	108.61.23.129
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	108.61.23.129
 ns	300	IN	AAAA	2001:19f0:5c00:4daa:5400:06ff:fe2d:38fa 
 ns	300	IN	A	64.177.113.227
 mail	300	IN	A	155.138.160.10
 old-mailu	300	IN	A	66.42.75.247
 ssh	300	IN	A	45.77.1.152
-git	300	IN	CNAME	git.supportedsystems.net
+git	300	IN	CNAME	git.supportedsystems.net.
 *	60	IN	A	108.61.23.129
 up	300	IN	A	45.63.92.95
 vpn	300	IN	A	45.77.1.152
@@ -74,59 +87,59 @@ ollama-a40ls-1	300	IN	A	96.30.196.136
 ollama-gh200-1	300	IN	A	155.138.192.146
 ollama-gh200-2	300	IN	A	155.138.229.176
 ollama-gh200-3	300	IN	A	144.202.23.41
-l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net
-*.l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net
+l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net.
+*.l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net.
 twilio.sip	300	IN	A	108.61.23.129
 cucm-pub.phones	300	IN	A	192.168.1.128
 cucm-sub1.phones	300	IN	A	192.168.1.129
 ccx-pub.phones	300	IN	A	192.168.1.130
 ccx-sub1.phones	300	IN	A	192.168.1.131
-autoconfig	3600	IN	CNAME	mail.supported.systems
-autodiscover	300	IN	CNAME	mail.supported.systems
-imap	300	IN	CNAME	mail.supported.systems
-smtp	300	IN	CNAME	mail.supported.systems
-pop	300	IN	CNAME	mail.supported.systems
-webmail	300	IN	CNAME	mail.supported.systems
-*.vpn	300	IN	CNAME	vpn.supported.systems
-app.mcpmc-1.l	300	IN	CNAME	mpmc-1.l.supported.systems
-auth.llm-fusion-mcp.l	300	IN	CNAME	llm-fusion-mcp.l.supported.systems
-*.llm-fusion-mcp.l	300	IN	CNAME	llm-fusion-mcp.l.supported.systems
-*.mcpmc-1.l	300	IN	CNAME	mcpmc-1.l.supported.systems
-*.unger-todo.l	300	IN	CNAME	unger-todo.l.supported.systems
-*.tigerstyle.l	300	IN	CNAME	tigerstyle.l.supported.systems
-*.marcia.l	300	IN	CNAME	marcia.l.supported.systems
-*.mcp-vultr.l	300	IN	CNAME	mcp-vultr.l.supported.systems
-*.room-scanner.l	300	IN	CNAME	room-scanner.l.supported.systems
-*.pages.l	300	IN	CNAME	pages.l.supported.systems
-*.mcp-client-test.l	300	IN	CNAME	mcp-client-test.l.supported.systems
-*.magicplan.l	300	IN	CNAME	magicplan.l.supported.systems
-*.whereis.l	300	IN	CNAME	l.supported.systems
-*.leads.l	300	IN	CNAME	l.supported.systems
-*.portal.l	300	IN	CNAME	portal.l.supported.systems
-*.www.l	300	IN	CNAME	www.l.supported.systems
-*.matrix.l	300	IN	CNAME	matrix.l.supported.systems
-ollama	300	IN	CNAME	gpu-1.supported.systems
-speech	300	IN	CNAME	gpu-2.supported.systems
-chat.ollama	300	IN	CNAME	gpu-1.supported.systems
-*.hure	300	IN	CNAME	hure.supported.systems
-dafuk	300	IN	CNAME	hure.supported.systems
-*.tigerstyle	300	IN	CNAME	tigerstyle.supported.systems
-ei.l	300	IN	CNAME	idx.l.supported.systems
-vllm	300	IN	CNAME	gpu-0.supported.systems
-*.gpu-0	300	IN	CNAME	gpu-0.supported.systems
-llm	300	IN	CNAME	lb.gpu.supported.systems
-*.sip	300	IN	CNAME	sip.supported.systems
-s120	300	IN	CNAME	docker-2.supportedsystems.net
-docs	300	IN	CNAME	docker-2.supportedsystems.net
-*.docs	300	IN	CNAME	docker-2.supportedsystems.net
-mcbluetooth	300	IN	CNAME	docker-2.supportedsystems.net
-	300	IN	MX	10	mail.supported.systems
-	3600	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
-	3600	IN	TXT	"google-site-verification=15bc_L-lCtt0kqBDSaxT92-ftzENYEfMuHv3g7yVNS8"
+autoconfig	3600	IN	CNAME	mail.supported.systems.
+autodiscover	300	IN	CNAME	mail.supported.systems.
+imap	300	IN	CNAME	mail.supported.systems.
+smtp	300	IN	CNAME	mail.supported.systems.
+pop	300	IN	CNAME	mail.supported.systems.
+webmail	300	IN	CNAME	mail.supported.systems.
+*.vpn	300	IN	CNAME	vpn.supported.systems.
+app.mcpmc-1.l	300	IN	CNAME	mpmc-1.l.supported.systems.
+auth.llm-fusion-mcp.l	300	IN	CNAME	llm-fusion-mcp.l.supported.systems.
+*.llm-fusion-mcp.l	300	IN	CNAME	llm-fusion-mcp.l.supported.systems.
+*.mcpmc-1.l	300	IN	CNAME	mcpmc-1.l.supported.systems.
+*.unger-todo.l	300	IN	CNAME	unger-todo.l.supported.systems.
+*.tigerstyle.l	300	IN	CNAME	tigerstyle.l.supported.systems.
+*.marcia.l	300	IN	CNAME	marcia.l.supported.systems.
+*.mcp-vultr.l	300	IN	CNAME	mcp-vultr.l.supported.systems.
+*.room-scanner.l	300	IN	CNAME	room-scanner.l.supported.systems.
+*.pages.l	300	IN	CNAME	pages.l.supported.systems.
+*.mcp-client-test.l	300	IN	CNAME	mcp-client-test.l.supported.systems.
+*.magicplan.l	300	IN	CNAME	magicplan.l.supported.systems.
+*.whereis.l	300	IN	CNAME	l.supported.systems.
+*.leads.l	300	IN	CNAME	l.supported.systems.
+*.portal.l	300	IN	CNAME	portal.l.supported.systems.
+*.www.l	300	IN	CNAME	www.l.supported.systems.
+*.matrix.l	300	IN	CNAME	matrix.l.supported.systems.
+ollama	300	IN	CNAME	gpu-1.supported.systems.
+speech	300	IN	CNAME	gpu-2.supported.systems.
+chat.ollama	300	IN	CNAME	gpu-1.supported.systems.
+*.hure	300	IN	CNAME	hure.supported.systems.
+dafuk	300	IN	CNAME	hure.supported.systems.
+*.tigerstyle	300	IN	CNAME	tigerstyle.supported.systems.
+ei.l	300	IN	CNAME	idx.l.supported.systems.
+vllm	300	IN	CNAME	gpu-0.supported.systems.
+*.gpu-0	300	IN	CNAME	gpu-0.supported.systems.
+llm	300	IN	CNAME	lb.gpu.supported.systems.
+*.sip	300	IN	CNAME	sip.supported.systems.
+s120	300	IN	CNAME	docker-2.supportedsystems.net.
+docs	300	IN	CNAME	docker-2.supportedsystems.net.
+*.docs	300	IN	CNAME	docker-2.supportedsystems.net.
+mcbluetooth	300	IN	CNAME	docker-2.supportedsystems.net.
+@	300	IN	MX	10	mail.supported.systems.
+@	3600	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
+@	3600	IN	TXT	"google-site-verification=15bc_L-lCtt0kqBDSaxT92-ftzENYEfMuHv3g7yVNS8"
 _dmarc	3600	IN	TXT	"v=DMARC1; p=reject; rua=mailto:reports@supported.systems; adkim=s; aspf=s;"
 dkim._domainkey	3600	IN	TXT	"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuGPt3zH0RxxDUW1Wg+3FOKIYNQy5vo/hvbPB/U6O7hh5K/SnQ2MDPfnL3B+Ur3kKmYFcSTdVMotr9Ds7wRJWFv49oK4f4VKxfoBD8Sh9GrJDNDM+g86h8M1v3cWKLdeRa+UczJDLRb9wwW8eRR17OQafqGupN0ZbsazbZwTrC5z/RZlLBtEMsIceWwHP hR+H3Bl9rH2t1RQSjbD2A9fM5EPXeVvzn9SwDpxgfMRfs7/k/prPASxW0/8Bun3k2BOzOjP/H4v509xTJOn/6S5eC2QJ47hw5XsjOu1j9Fy2YqUkgDpcrqLiS5K/7E+BSWURitfuxAamv+vkTfrbU3D0lQIDAQAB"
 supported.systems._report._dmarc.mail	3600	IN	TXT	"v=DMARC1;"
-	3600	IN	TXT	"openai-domain-verification=dv-U5gJT4fmfg0LnrKfBgmv5vt6"
+@	3600	IN	TXT	"openai-domain-verification=dv-U5gJT4fmfg0LnrKfBgmv5vt6"
 _25._tcp.mail	86400	IN	TXT	"2 1 1 0b9fa5a59eed715c26c1020c711b4f6ec42d58b0015e14337a39dad301c5afc3"
 qubeseptic.com._report._dmarc.mail	300	IN	TXT	"v=DMARC1;"
 _twilio	300	IN	TXT	"twilio-domain-verification=efffc13bf1b402210d9d2b65e3532a48"
diff --git a/zones/supportedsystems.com.zone b/zones/supportedsystems.com.zone
index 867b345..bbb9297 100644
--- a/zones/supportedsystems.com.zone
+++ b/zones/supportedsystems.com.zone
@@ -1,11 +1,27 @@
-; Zone file for supportedsystems.com
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/supportedsystems.com.zone
 $ORIGIN supportedsystems.com.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.supportedsystems.com. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	supported.systems
-	3600	IN	MX	10	mail.supported.systems
-	3600	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	supported.systems.
+@	3600	IN	MX	10	mail.supported.systems.
+@	3600	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
diff --git a/zones/supportedsystems.net.zone b/zones/supportedsystems.net.zone
index 5c3ac1b..58fc5cf 100644
--- a/zones/supportedsystems.net.zone
+++ b/zones/supportedsystems.net.zone
@@ -1,15 +1,31 @@
-; Zone file for supportedsystems.net
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/supportedsystems.net.zone
 $ORIGIN supportedsystems.net.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.supportedsystems.net. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
 docker-1	300	IN	A	108.61.23.129
 docker-1	300	IN	AAAA	2001:19f0:0:39a2:5400:6ff:fe2d:a42
 docker-2	300	IN	A	64.177.113.31
 docker-2	300	IN	AAAA	2001:19f0:5c00:4bab:5400:6ff:fe2d:1f52
 git	300	IN	A	64.177.112.188
-*	300	IN	CNAME	supportedsystems.net
-	3600	IN	MX	1	mail.supported.systems
\ No newline at end of file
+*	300	IN	CNAME	supportedsystems.net.
+@	3600	IN	MX	1	mail.supported.systems.
diff --git a/zones/syslog.chat.zone b/zones/syslog.chat.zone
index 9d1a99a..de1bb86 100644
--- a/zones/syslog.chat.zone
+++ b/zones/syslog.chat.zone
@@ -1,10 +1,26 @@
-; Zone file for syslog.chat
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/syslog.chat.zone
 $ORIGIN syslog.chat.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.syslog.chat. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.226
-*	300	IN	CNAME	syslog.chat
-	300	IN	MX	10	syslog.chat
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.226
+*	300	IN	CNAME	syslog.chat.
+@	300	IN	MX	10	syslog.chat.
diff --git a/zones/tatemalloy.com.zone b/zones/tatemalloy.com.zone
index 4301e76..128d097 100644
--- a/zones/tatemalloy.com.zone
+++ b/zones/tatemalloy.com.zone
@@ -1,15 +1,31 @@
-; Zone file for tatemalloy.com
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/tatemalloy.com.zone
 $ORIGIN tatemalloy.com.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.tatemalloy.com. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	tatemalloy.com
-mail	300	IN	CNAME	mail.supported.systems
-	300	IN	MX	10	mail.supported.systems
-	3600	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	tatemalloy.com.
+mail	300	IN	CNAME	mail.supported.systems.
+@	300	IN	MX	10	mail.supported.systems.
+@	3600	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
 _acme-challenge	300	IN	TXT	"zoUmIIDLDdYsMwc-o_q89XJqguhxdh-GG2f1Ry35Mzg"
 _acme-challenge	300	IN	TXT	"GR_EICKHgxOHXGzU26ZrmuqES-RQk4KTRbT9ackqIIQ"
 _acme-challenge	300	IN	TXT	"E1znurfm5S4wzw9xP6OXRIyJ3qqOnyivRkqcBdB5i0k"
@@ -22,4 +38,4 @@ _acme-challenge	300	IN	TXT	"U4lSaBVa8-UIBwQ5zS3_YuozLTWZ6KRrkdP2RWF0INM"
 _acme-challenge	300	IN	TXT	"ima5uh3kXccKFf35ZCLfalZT4XbQJB05GnyvtAIqYTw"
 _acme-challenge	300	IN	TXT	"LWUF146g8xiEiWdYY6pWb2iwCm5bE4i1vLjt2w9Mx2U"
 _acme-challenge	300	IN	TXT	"SHktbBbFNl-03DimuwNBin1NyL7x7GD5vN7jNlhs0wU"
-_acme-challenge	300	IN	TXT	"5yvO_8LolWXqsy8PxrqBL-RWaWzKnccWN0L4XiFWwgE"
\ No newline at end of file
+_acme-challenge	300	IN	TXT	"5yvO_8LolWXqsy8PxrqBL-RWaWzKnccWN0L4XiFWwgE"
diff --git a/zones/tateorrtot.games.zone b/zones/tateorrtot.games.zone
index 1ac67b1..2369b8f 100644
--- a/zones/tateorrtot.games.zone
+++ b/zones/tateorrtot.games.zone
@@ -1,11 +1,27 @@
-; Zone file for tateorrtot.games
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/tateorrtot.games.zone
 $ORIGIN tateorrtot.games.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.tateorrtot.games. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	162.43.207.251
-	300	IN	AAAA	2605:21c0:1000:53:250:56ff:fe91:5415
-*	300	IN	CNAME	tateorrtot.games
-	300	IN	MX	10	mail.supported.system
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	162.43.207.251
+@	300	IN	AAAA	2605:21c0:1000:53:250:56ff:fe91:5415
+*	300	IN	CNAME	tateorrtot.games.
+@	300	IN	MX	10	mail.supported.system.
diff --git a/zones/timber.ink.zone b/zones/timber.ink.zone
index 9ffe0da..9ae90b6 100644
--- a/zones/timber.ink.zone
+++ b/zones/timber.ink.zone
@@ -1,14 +1,30 @@
-; Zone file for timber.ink
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/timber.ink.zone
 $ORIGIN timber.ink.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.timber.ink. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
 l	300	IN	A	127.0.0.1
-*	300	IN	CNAME	timber.ink
-*.l	300	IN	CNAME	l.timber.ink
-	300	IN	MX	10	timber.ink
+*	300	IN	CNAME	timber.ink.
+*.l	300	IN	CNAME	l.timber.ink.
+@	300	IN	MX	10	timber.ink.
 _acme-challenge.l	300	IN	TXT	"Zf92MXoRMCkCDinlu7yQ31Cp7gGg30Kilc9lVbF-l8w"
-_acme-challenge.api.l	300	IN	TXT	"IJy9QiaLG4tJ_-T5X7VMVdFftTRRH7R_zKdoQRr8IGs"
\ No newline at end of file
+_acme-challenge.api.l	300	IN	TXT	"IJy9QiaLG4tJ_-T5X7VMVdFftTRRH7R_zKdoQRr8IGs"
diff --git a/zones/trackfeeds.cloud.zone b/zones/trackfeeds.cloud.zone
index b6b2164..2cd81b8 100644
--- a/zones/trackfeeds.cloud.zone
+++ b/zones/trackfeeds.cloud.zone
@@ -1,15 +1,31 @@
-; Zone file for trackfeeds.cloud
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/trackfeeds.cloud.zone
 $ORIGIN trackfeeds.cloud.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.trackfeeds.cloud. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
 l	300	IN	A	10.20.0.38
-*	300	IN	CNAME	trackfeeds.cloud
-*.l	300	IN	CNAME	l.trackfeeds.cloud
-	300	IN	MX	10	trackfeeds.cloud
+*	300	IN	CNAME	trackfeeds.cloud.
+*.l	300	IN	CNAME	l.trackfeeds.cloud.
+@	300	IN	MX	10	trackfeeds.cloud.
 _acme-challenge	300	IN	TXT	"sKMvgTw0q22DS6SWpYXtuuaawKlkhlQZS4VDoBCnA5M"
 _acme-challenge	300	IN	TXT	"tHTPgG3uSXwoBu6ulChvsyxzOn4wCb0IVrdfz9PUiwg"
 _acme-challenge	300	IN	TXT	"J7ggXe7lmq6zbL3nKfMUbOi8PPDeJDiIgsBsO36Cd2Q"
@@ -24,4 +40,4 @@ _acme-challenge	300	IN	TXT	"4azVDm_9EH1QheQbbM1WPmtdhlZzPBNDp7QseCBmrsY"
 _acme-challenge	300	IN	TXT	"WpsM92QpKO-BEpe46sSvYAjsFeCRyj0rQYNvQOMDapo"
 _acme-challenge	300	IN	TXT	"FstZtHdbdkmUKZRc4XF7YTYXw4IOYZDjpR9awQio3NI"
 _acme-challenge	300	IN	TXT	"997TMR_EEeDQlWaaFkefhMVBfjGSurhm4UZhWPrfeR8"
-_acme-challenge	300	IN	TXT	"QuLiHfwQDjatKUV_y0AmKx5lqhtTcUTxCgBA35BRZgg"
\ No newline at end of file
+_acme-challenge	300	IN	TXT	"QuLiHfwQDjatKUV_y0AmKx5lqhtTcUTxCgBA35BRZgg"
diff --git a/zones/tuckermalloy.com.zone b/zones/tuckermalloy.com.zone
index c9f0c77..17dff1c 100644
--- a/zones/tuckermalloy.com.zone
+++ b/zones/tuckermalloy.com.zone
@@ -1,13 +1,29 @@
-; Zone file for tuckermalloy.com
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/tuckermalloy.com.zone
 $ORIGIN tuckermalloy.com.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.tuckermalloy.com. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-*	300	IN	CNAME	tuckermalloy.com
-	300	IN	MX	10	tuckermalloy.com
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+*	300	IN	CNAME	tuckermalloy.com.
+@	300	IN	MX	10	tuckermalloy.com.
 _acme-challenge	300	IN	TXT	"TDRs9UeCuV_oxivongFlJSHA5A9ky0epe4_yC5ACUyI"
 _acme-challenge	300	IN	TXT	"ig-bSaPcTscjbFlEo3yK7PXDbrps99TEnqgwjaN-D0U"
 _acme-challenge	300	IN	TXT	"7JP0aoiLiaRC0dnMemCSe2mqJltAfaJukPXFfLG37-w"
@@ -19,4 +35,4 @@ _acme-challenge	300	IN	TXT	"Q_WAPa_6yO46D9EgS5U9qRXCSw8FdTuKeSvpsemE79M"
 _acme-challenge	300	IN	TXT	"qc0BcwZ6TNegvZ9Ymq4ymmBbbuBPJquzLq3mwMpnRQA"
 _acme-challenge	300	IN	TXT	"fguL4374pHh2OmuWOFr5dbR3kGgQ6GVHyOSXxgO5WvY"
 _acme-challenge	300	IN	TXT	"RXUofc6dg3bYPndu75PEN8agJQase92ZIv0FwOt9u-A"
-_acme-challenge	300	IN	TXT	"a-o_fe9bHrENho0_jeiwrZ1o0X3ZW_a-Gxq1XD5Qs78"
\ No newline at end of file
+_acme-challenge	300	IN	TXT	"a-o_fe9bHrENho0_jeiwrZ1o0X3ZW_a-Gxq1XD5Qs78"
diff --git a/zones/upc.llc.zone b/zones/upc.llc.zone
index dd6ce7a..ce18a38 100644
--- a/zones/upc.llc.zone
+++ b/zones/upc.llc.zone
@@ -1,24 +1,40 @@
-; Zone file for upc.llc
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/upc.llc.zone
 $ORIGIN upc.llc.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.upc.llc. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
+
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
 l	300	IN	A	127.0.0.1
-	300	IN	A	108.61.23.129
+@	300	IN	A	108.61.23.129
 *	300	IN	A	108.61.23.129
-	300	IN	AAAA	2001:19f0:5c01:12ca:5400:5ff:fe35:a427
+@	300	IN	AAAA	2001:19f0:5c01:12ca:5400:5ff:fe35:a427
 *	300	IN	AAAA	2001:19f0:5c01:12ca:5400:5ff:fe35:a427
-*.l	300	IN	CNAME	l.upc.llc
-mail	300	IN	CNAME	mail.supported.systems
-autoconfig	600	IN	CNAME	mail.upc.llc
-*.portal.l	300	IN	CNAME	portal.l.upc.llc
-*.s3	300	IN	CNAME	s3.upc.llc
-*.report.l	300	IN	CNAME	report.l.upc.llc
-*.report	300	IN	CNAME	report.upc.llc
-	300	IN	MX	10	upc.llc
-	300	IN	MX	10	mail.supported.systems
+*.l	300	IN	CNAME	l.upc.llc.
+mail	300	IN	CNAME	mail.supported.systems.
+autoconfig	600	IN	CNAME	mail.upc.llc.
+*.portal.l	300	IN	CNAME	portal.l.upc.llc.
+*.s3	300	IN	CNAME	s3.upc.llc.
+*.report.l	300	IN	CNAME	report.l.upc.llc.
+*.report	300	IN	CNAME	report.upc.llc.
+@	300	IN	MX	10	upc.llc.
+@	300	IN	MX	10	mail.supported.systems.
 _acme-challenge.l	300	IN	TXT	"LZGNwW9DGUuN2ly0vm5czSrRIG20lqx--6Gd4j1x71w"
 _acme-challenge.l	300	IN	TXT	"sSIwSVfZ2ceW8ie8aYXrzf73iEWMZSXl9e6ogxFQNCc"
 _acme-challenge.l	300	IN	TXT	"Z4fh4rHw8d-GR-L3cnocj8o-8OpI5GccMwWRQiUnPd0"
@@ -26,7 +42,7 @@ _acme-challenge.l	300	IN	TXT	"8kd2q8Ib7DFvq8SAGsKTtxU2qLV7L8E_ePD8Ww2MVfA"
 _acme-challenge.l	300	IN	TXT	"q-aWCBE1lMD0_xcNzwWydAW7bk3tLzMIWYi2z0WapWE"
 _acme-challenge.l	300	IN	TXT	"p3G13Tmd-S47IDPo2Zjq4NJjQZ9qJyZw_izjte3Y9ps"
 _acme-challenge.www.l	300	IN	TXT	"9vR7zAbgH0Tbfhmz5Mi94XtjS1St8r7ZOulkgn1Jo_s"
-	300	IN	TXT	"v=spf1 include:mail.supported.systems ~all"
+@	300	IN	TXT	"v=spf1 include:mail.supported.systems ~all"
 _acme-challenge.s3	300	IN	TXT	"e_fyF4DWbCUGErurD1HxCWY67I5868wAODGSbqR2CKE"
 _acme-challenge.oscar-admin.l	300	IN	TXT	"CuCSK7VwXgrIkFCniISQTysR9YasyYZGGR_npvLkvTM"
 _acme-challenge.or	300	IN	TXT	"sZUOOMwyY7i0iBeGJDvT770cbxYBZ1YTcJhVSgAm8PM"
@@ -43,9 +59,7 @@ _autodiscover._tcp	600	IN	SRV	10	0	443	mail.upc.llc.
 _submissions._tcp	600	IN	SRV	10	0	465	mail.upc.llc.
 _imaps._tcp	600	IN	SRV	10	0	993	mail.upc.llc.
 _pop3s._tcp	600	IN	SRV	10	0	995	mail.upc.llc.
-; Explicit CNAMEs added to fix RFC 4592 empty-non-terminal cases
-; (parent name has _acme-challenge children, so wildcard would skip it)
-catalog	300	IN	CNAME	upc.llc
-minio.or	300	IN	CNAME	upc.llc
-or	300	IN	CNAME	upc.llc
-s3	300	IN	CNAME	upc.llc
+catalog	300	IN	CNAME	upc.llc.
+minio.or	300	IN	CNAME	upc.llc.
+or	300	IN	CNAME	upc.llc.
+s3	300	IN	CNAME	upc.llc.
diff --git a/zones/warehack.ing.zone b/zones/warehack.ing.zone
index f7b92b0..f05667a 100644
--- a/zones/warehack.ing.zone
+++ b/zones/warehack.ing.zone
@@ -1,14 +1,30 @@
-; Zone file for warehack.ing
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/warehack.ing.zone
 $ORIGIN warehack.ing.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.warehack.ing. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	64.177.113.31
-l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net
-*.l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net
-*	300	IN	CNAME	warehack.ing
-git	300	IN	CNAME	idahomuellers.fortiddns.com
-juliet	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net
-	300	IN	MX	10	warehack.ing
\ No newline at end of file
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	64.177.113.31
+l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net.
+*.l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net.
+*	300	IN	CNAME	warehack.ing.
+git	300	IN	CNAME	idahomuellers.fortiddns.com.
+juliet	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net.
+@	300	IN	MX	10	warehack.ing.
diff --git a/zones/westboise.org.zone b/zones/westboise.org.zone
index 7bb9105..900584d 100644
--- a/zones/westboise.org.zone
+++ b/zones/westboise.org.zone
@@ -1,15 +1,31 @@
-; Zone file for westboise.org
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/westboise.org.zone
 $ORIGIN westboise.org.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.westboise.org. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	74.91.22.234
-	300	IN	AAAA	2001:19f0:5:4dab:3eec:efff:feb9:f65e
-*	300	IN	CNAME	westboise.org
-	300	IN	MX	10	mail.supported.systems
-	3600	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	74.91.22.234
+@	300	IN	AAAA	2001:19f0:5:4dab:3eec:efff:feb9:f65e
+*	300	IN	CNAME	westboise.org.
+@	300	IN	MX	10	mail.supported.systems.
+@	3600	IN	TXT	"v=spf1 mx a:mail.supported.systems ~all"
 _acme-challenge	300	IN	TXT	"05EbsyARBzLskBoEHUwM99Togj1S-p0KEjeU6qnuR7E"
 _acme-challenge	300	IN	TXT	"hk4LRncjXHz7HfpRM5euUNJjoj8i8srHZhoKoy6T36M"
 _acme-challenge	300	IN	TXT	"SHz7RNa2PcPyJvCqhTsQlGzIq1zZsjbqP-sifMoUsck"
@@ -21,4 +37,4 @@ _acme-challenge	300	IN	TXT	"5C_jASC_w_Dl-8H0VeKTPQWneH4HY4ZFbzgUV9EuwJs"
 _acme-challenge	300	IN	TXT	"1SgYQJScXjkWRdST4WxXrjp8dSFxI-NWxhRkJDn1BfA"
 _acme-challenge	300	IN	TXT	"B00-RbjOp-mGxX_WkFng6tEoyxzhGe334bclADHMb-Y"
 _acme-challenge	300	IN	TXT	"du82JOyEWbbRXlyVSqPpl38uGzJ-ZfLin3cZ2oeuPEY"
-_acme-challenge	300	IN	TXT	"sYmya4OTlYsdu8b3X1k1es5GivxqKddOH52g2mGAfy4"
\ No newline at end of file
+_acme-challenge	300	IN	TXT	"sYmya4OTlYsdu8b3X1k1es5GivxqKddOH52g2mGAfy4"
diff --git a/zones/zmesh.systems.zone b/zones/zmesh.systems.zone
index abf33bc..5d2ec2e 100644
--- a/zones/zmesh.systems.zone
+++ b/zones/zmesh.systems.zone
@@ -1,18 +1,34 @@
-; Zone file for zmesh.systems
-; Generated by mcp-vultr
+; Auto-prepared by scripts/prepare-zones.sh on 2026-05-21T11:12:50-06:00
+; Source: zones/zmesh.systems.zone
 $ORIGIN zmesh.systems.
 $TTL 3600
+@ 3600 IN SOA ns1.he.net. admin.zmesh.systems. (
+    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    300         ; refresh (5 min) — slaves poll us this often;
+                ;   tightened from 3600 to nudge HE's internal
+                ;   puller→anycast replication
+    120         ; retry   (2 min) — kept < refresh per RFC 1912
+    604800      ; expire  (1 week)
+    60          ; minimum (1 min) — negative-cache TTL on public
+                ;   resolvers; shrinks the window when an old
+                ;   NXDOMAIN keeps showing after we add a name
+    )
 
-	300	IN	NS	ns1.vultr.com
-	300	IN	NS	ns2.vultr.com
-	300	IN	A	64.177.113.31
-l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net
-*.l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net
-*	300	IN	CNAME	zmesh.systems
-	300	IN	MX	10	zmesh.systems
-	300	IN	MX	5	mail.supported.systems
-	3600	IN	TXT	"Hey Hacker! Get Meshed!"
+@ 3600 IN NS ns1.he.net.
+@ 3600 IN NS ns2.he.net.
+@ 3600 IN NS ns3.he.net.
+@ 3600 IN NS ns4.he.net.
+@ 3600 IN NS ns5.he.net.
+
+
+@	300	IN	A	64.177.113.31
+l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net.
+*.l	300	IN	CNAME	rpm-bullet.mer.idahomuellers.net.
+*	300	IN	CNAME	zmesh.systems.
+@	300	IN	MX	10	zmesh.systems.
+@	300	IN	MX	5	mail.supported.systems.
+@	3600	IN	TXT	"Hey Hacker! Get Meshed!"
 _acme-challenge.mcbladerf.l	300	IN	TXT	"IgoOIhuVXLkIkZNJ33oKvBw9tILVCoYxEowmYQEIw78"
 _acme-challenge.mcbladerf.l	300	IN	TXT	"pufwOaC6xoP2aKScyhAiaip5_cpTIpeYnctX97lkq3Y"
 _acme-challenge.esp32.l	300	IN	TXT	"hZphEA1D26kvK-okdIU0Z8eqBTQs5WxoVVIPwt16Z58"
-_acme-challenge.astrolock.l	300	IN	TXT	"bxJ5IOYNkE8WCoyA0fLm7bMBQaOOU4NzZZg0WT0dy2g"
\ No newline at end of file
+_acme-challenge.astrolock.l	300	IN	TXT	"bxJ5IOYNkE8WCoyA0fLm7bMBQaOOU4NzZZg0WT0dy2g"