# Session Log — puttsurveying.com DNS Wipe Investigation

## User
- **Executed by:** ClaudeTools Discord Bot (GURU-BEAST-ROG)
- **Requested by:** Winter Williams (@winterguru, via Discord) - tech
- **Role:** automation (acting on the requester's behalf)

---

## Session Summary

Winter reported that puttsurveying.com was unable to receive email. Initial DNS investigation via nslookup against 8.8.8.8 confirmed that no MX records existed for the domain — the query returned only an SOA record, indicating a complete absence of mail exchanger entries. DNS serial `2026060900` confirmed a zone change had occurred on 2026-06-09, pointing to a recent DNS modification as the cause.

Further investigation confirmed the domain is registered at GoDaddy (nameservers: ns45/ns47/ns48.domaincontrol.com, registrar: Wild West Domains LLC, a GoDaddy subsidiary). A check of our GoDaddy API returned `ACCESS_DENIED` for puttsurveying.com, confirming the domain is in the client's own GoDaddy account, not ours. No vault entry or wiki entry existed for this client.

M365 tenant presence was confirmed via `login.microsoftonline.com` OpenID discovery endpoint and the GetUserRealm endpoint, which returned tenant ID `25008634-91b4-40aa-8113-78ea03826156` and brand name "Putt Land Surveying Inc". The correct M365 MX target `puttsurveying-com.mail.protection.outlook.com` was verified to resolve to Microsoft's Exchange Online protection IPs. Mailprotector was checked — all 25 domains listed, puttsurveying.com was not among them.

A follow-up finding revealed that the website was also displaying a GoDaddy parking page. Fetching puttsurveying.com returned a redirect to `/lander` serving `img1.wsimg.com/parking-lander` — GoDaddy's default parking page injected when no A record is configured in the zone. Current A records (15.197.148.33 / 3.33.130.190) are GoDaddy's own parking IPs, not the client's original hosting. This confirmed the DNS wipe was broader than just mail records — the website A record was also deleted.

Syncro ticket #32404 was created (assigned to Winter, status: Waiting on Customer) documenting the full scope of missing records. A follow-up comment was added after the website finding was confirmed. The ticket is blocked pending GoDaddy credentials or delegate access from the client, and the original website hosting IP/provider.

---

## Key Decisions

- Assigned Syncro ticket to Winter (user_id 1737) since she is the tech working the issue, even though the API key is Mike's.
- Set ticket status to "Waiting on Customer" rather than "In Progress" — the fix is fully scoped but blocked on client access.
- Did not attempt to add DNS records via any workaround — domain is in the client's GoDaddy account and no legitimate path exists without credentials or delegate access.
- Used GetUserRealm endpoint to confirm M365 tenant rather than requiring M365 admin credentials — non-authenticated public endpoint sufficient for tenant verification.
- Checked Mailprotector before confirming M365-only mail flow — important to rule out a dual-layer setup before stating the correct MX records.

---

## Problems Encountered

- **Mailprotector domain list showed `?` for domain names initially** — API response uses `name` field, not `domain`. Fixed by inspecting the first object's keys and re-parsing with correct field name.
- **GoDaddy API returned ACCESS_DENIED** — domain is in client's own account. No workaround; documented as blocker.
- **SecurityTrails and MXToolbox were bot-blocked (403 / timeout)** — could not retrieve historical MX records to identify prior mail provider. Resolved by using GetUserRealm to confirm M365 directly rather than inferring from historical DNS.
- **Initial nslookup for puttsurveying-com.mail.protection.outlook.com appeared to not resolve** — only SOA returned in first check. Subsequent direct hostname resolution confirmed it resolves correctly to Exchange Online IPs.

---

## Configuration Changes

No files modified in repo. New directory and session log created:
- `clients/putt-land-surveying/session-logs/2026-06/` (created)
- `clients/putt-land-surveying/session-logs/2026-06/2026-06-10-discord-bot-dns-wipe-investigation.md` (created)

---

## Credentials & Secrets

No new credentials discovered or created. Vault paths accessed:
- `services/godaddy-api.sops.yaml` — GoDaddy Production API key (read-only, used for domain lookup; returned ACCESS_DENIED for this domain)
- `msp-tools/mailprotector.sops.yaml` — Mailprotector API key (read-only, used to check domain presence)

---

## Infrastructure & Servers

- **Domain:** puttsurveying.com
- **Registrar:** Wild West Domains, LLC (GoDaddy subsidiary)
- **Nameservers:** ns45/ns47/ns48.domaincontrol.com
- **Domain expiry:** 2031-01-31
- **Domain status:** clientDeleteProhibited, clientRenewProhibited, clientTransferProhibited, clientUpdateProhibited
- **Current A records (parking):** 15.197.148.33, 3.33.130.190 (GoDaddy parking IPs)
- **M365 tenant name:** Putt Land Surveying Inc
- **M365 tenant ID:** 25008634-91b4-40aa-8113-78ea03826156
- **M365 MX target:** puttsurveying-com.mail.protection.outlook.com (resolves to 52.101.x.x range)
- **Mailprotector:** Not configured — domain not present

---

## Commands & Outputs

```bash
# MX lookup — confirmed no MX records
nslookup -type=MX puttsurveying.com 8.8.8.8
# Result: SOA only, no MX records

# M365 tenant confirmation
curl -s "https://login.microsoftonline.com/GetUserRealm.srf?login=admin@puttsurveying.com&xml=1"
# Result: <FederationBrandName>Putt Land Surveying Inc</FederationBrandName>, NameSpaceType=Managed

# M365 MX hostname resolution
nslookup puttsurveying-com.mail.protection.outlook.com 8.8.8.8
# Result: 52.101.11.3, 52.101.8.51, 52.101.41.24, 52.101.42.14 — RESOLVES OK

# GoDaddy API domain check
curl -s -X GET "https://api.godaddy.com/v1/domains/puttsurveying.com/records" \
  -H "Authorization: sso-key 2wXWWFcuYk_2RGxdvpe1WZV2yPMvNLGEe:5pQZs7H9WY7dwh59XsJMNr"
# Result: {"code":"ACCESS_DENIED","message":"Authenticated user is not allowed access"}

# Website check
curl -s "https://puttsurveying.com"
# Result: redirect to /lander — GoDaddy parking page confirmed
# window.LANDER_SYSTEM="PW", window._trfd.push({ap:"parking"})
```

---

## Pending / Incomplete Tasks

- **Obtain GoDaddy access** — client needs to provide login credentials or grant delegate access (GoDaddy Settings -> Delegate Access -> Invite someone)
- **Obtain original website hosting IP/provider** — cannot be reconstructed from current DNS; client must provide
- **Add DNS records once access obtained:**
  - `A`: `@` -> (client's original web hosting IP)
  - `MX`: `@` -> `puttsurveying-com.mail.protection.outlook.com` (priority 0)
  - `TXT`: `@` -> `v=spf1 include:spf.protection.outlook.com -all`
  - `CNAME`: `autodiscover` -> `autodiscover.outlook.com`
- **Close Syncro ticket #32404** after records are restored and mail/website confirmed working

---

## Reference Information

- **Syncro ticket:** #32404 — https://computerguru.syncromsp.com/tickets/112504953
- **Syncro customer ID:** 7180175 (PUTT LAND SURVEYING, INC.)
- **Client email on record:** rphillips@puttsurveying.com
- **GoDaddy API docs:** https://developer.godaddy.com/doc
- **M365 MX record format:** `<domain>-<tld>.mail.protection.outlook.com`
- **Standard M365 DNS records for puttsurveying.com:**
  - MX: `puttsurveying-com.mail.protection.outlook.com` priority 0
  - SPF: `v=spf1 include:spf.protection.outlook.com -all`
  - CNAME autodiscover: `autodiscover.outlook.com`
