DNS record set — Workspace rebrand mail cutover (for Jonathan)

Date: 2026-06-09 · Companion to: 2026-06-09-workspace-domain-rebrand-design.md Who applies these: Jonathan (Cloudflare DNS + Workspace Admin console). Claude drafted the values.

Verified live DNS 2026-06-09: nothing below is in place yet — cloudbase.foundation is still on Cloudflare Email Routing, and thecloudbasefoundation.org is missing SPF/DMARC. This is the exact set to apply, in order.

⚠️ Order matters — do these first

Lower TTLs before touching anything. In Cloudflare, set the existing cloudbase.foundation MX + apex TXT records to TTL 300 (5 min) a few hours ahead, so a rollback propagates fast.
Turn OFF Cloudflare Email Routing for cloudbase.foundation (Cloudflare dashboard → the zone → Email → Email Routing → disable). Email Routing owns the route{1,2,3}.mx.cloudflare.net MX records and will fight any manual MX you add. It must be off before the Google MX below will stick. Inventory the existing forwards first (info@, contact@) and recreate them as Workspace aliases/mailboxes (design Phase 1.2) so mail keeps landing after the switch.
Add + verify cloudbase.foundation as a secondary domain in Workspace (the google-site-verification TXT is already present, so verification should pass immediately).
Generate DKIM in Admin console (Apps → Google Workspace → Gmail → Authenticate email → select cloudbase.foundation, 2048-bit, selector google) — this produces the DKIM value for record set §A-3 below. You can't publish DKIM until Google generates it.

A. `cloudbase.foundation` — cut mail over to Google Workspace

Replace the Cloudflare Email Routing records with these.

A-1 · MX (delete the three `route*.mx.cloudflare.net` records)

Type   Name (host)            Priority   Value              TTL
MX     cloudbase.foundation   1          smtp.google.com.   300 (raise to 3600 after cutover)

Using single-host smtp.google.com to match what thecloudbasefoundation.org already runs. (Google's classic 5-record set — aspmx.l.google.com @1, alt1/alt2 @5, alt3/alt4 @10 — is equivalent if you prefer it; don't mix the two styles.)

A-2 · SPF (edit the existing apex TXT — do NOT add a second SPF record)

Type   Name                   Value                                          TTL
TXT    cloudbase.foundation   v=spf1 include:_spf.google.com ~all            3600

This replaces the current v=spf1 include:_spf.mx.cloudflare.net ~all.
Keep the existing google-site-verification=geM-… TXT record — it's a separate record, leave it.
⚠️ Only one v=spf1 TXT is allowed per domain. When ListMonk later sends as news@cloudbase.foundation (CRM roadmap Phase 2/6), merge its include into this same record — e.g. v=spf1 include:_spf.google.com include:<listmonk-spf-host> ~all — do not add a second SPF TXT.

A-3 · DKIM (value comes from the Admin-console step #4 above)

Type   Name                                   Value                              TTL
TXT    google._domainkey.cloudbase.foundation v=DKIM1; k=rsa; p=<GOOGLE-GENERATES-THIS>   3600

Paste the exact v=DKIM1; k=rsa; p=… string Google shows. 2048-bit keys are long — if Cloudflare splits it into quoted chunks that's fine, DNS concatenates them.
After publishing, return to the Admin console and click Start authentication.

A-4 · DMARC (new record — monitor mode first)

Type   Name                          Value                                                          TTL
TXT    _dmarc.cloudbase.foundation   v=DMARC1; p=none; rua=mailto:dmarc@cloudbase.foundation; fo=1  3600

p=none = monitor only, per design (tighten to quarantine/reject later, after reports look clean).
rua= must be an address that actually receives. Create dmarc@cloudbase.foundation (or point it at an existing inbox like info@). If you want reports to a third-party domain, that domain needs an authorization record — easiest to keep it on-domain.

B. `thecloudbasefoundation.org` — close the pre-existing gaps

The old domain stays as a lifelong alias and Google MX is already correct (smtp.google.com, leave it). But it currently has no SPF and no DMARC — worth fixing now, independent of the flip.

B-1 · SPF (new TXT — none exists today)

Type   Name                          Value                                 TTL
TXT    thecloudbasefoundation.org    v=spf1 include:_spf.google.com ~all   3600

Keep the existing google-site-verification=7CC_… TXT alongside it.

B-2 · DMARC (new TXT)

Type   Name                                 Value                                                                 TTL
TXT    _dmarc.thecloudbasefoundation.org    v=DMARC1; p=none; rua=mailto:dmarc@cloudbase.foundation; fo=1         3600

B-3 · DKIM (optional but recommended)

Workspace DKIM is opt-in per domain. If not already enabled here, generate it the same way as §4 and publish google._domainkey.thecloudbasefoundation.org with Google's value.

C. Verify after applying (Claude can run these)

# cloudbase.foundation should now show Google MX + Google SPF + DKIM + DMARC
dig +short MX  cloudbase.foundation                       # expect: 1 smtp.google.com.
dig +short TXT cloudbase.foundation                       # expect: v=spf1 include:_spf.google.com ~all  (+ google-site-verification)
dig +short TXT google._domainkey.cloudbase.foundation     # expect: v=DKIM1; k=rsa; p=...
dig +short TXT _dmarc.cloudbase.foundation                # expect: v=DMARC1; p=none; ...

# old domain gap-fill
dig +short TXT thecloudbasefoundation.org                 # expect SPF now present
dig +short TXT _dmarc.thecloudbasefoundation.org          # expect DMARC now present

Then send a test mail to info@cloudbase.foundation and confirm it lands in the Workspace mailbox, and run the domain through mxtoolbox.com / mail-tester.com for an independent SPF/DKIM/DMARC pass.

Only after all of §A verifies clean should the Phase 2 primary-domain flip proceed (design golden rule).