Welcome to the NZRT Wiki Podcast. Today we’re looking at SSL & DNS.

Let’s start with certificate coverage. NZRT runs four subdomains, and each one has its own SSL certificate managed through cPanel’s AutoSSL system using Let’s Encrypt. Those four subdomains are the main site at nzrtnetwork.com, the ERP system at erp.nzrtnetwork.com, the cloud storage instance at cloud.nzrtnetwork.com, and the mail server at mail.nzrtnetwork.com. All four certificates are stored in the same location — a folder called ssl inside the DavWWWRoot directory, accessed over a secure WebDAV connection. And here’s the good news: renewal is fully automatic. Let’s Encrypt certificates last ninety days, and cPanel handles the renewal cycle for you without any manual intervention needed on your end.

Now let’s talk about DNS records, because this is where things get a little more detailed. There are two groups of records you need to know about: core records and mail records.

Starting with the core records. You have a set of A records, which map your domain names to the actual server IP address. The root domain itself points to the server, and so does the www version of the domain. From there, you have three more A records for the subdomains: erp points to the server for Dolibarr, cloud points to it for Nextcloud, and mail points to it for the mail system. There is also the option of setting up a CNAME record for www that points back to nzrtnetwork.com — that is an alternative to using the A record for www, so you would choose one approach or the other.

Next are the mail records, and these are really important for making sure your outgoing email is trusted and does not end up in spam folders. First, you have an MX record on the root domain that routes all incoming mail to your mail server. Then there are three TXT records you need. The first is an SPF record, which tells the world that your mail server is authorised to send email on behalf of your domain. The second is a DMARC record, set on the underscore-dmarc subdomain, which defines a quarantine policy for emails that fail authentication checks and sends aggregate reports to the admin email address. The third TXT record lives on a subdomain called mail dot domainkey, and it holds your DKIM public key. DKIM adds a cryptographic signature to your outgoing emails so receiving servers can verify they genuinely came from you and have not been tampered with in transit.

Now let’s walk through the renewal checklist. There are four things you want to make sure are in place. First, confirm that AutoSSL is enabled in cPanel for all your subdomains — this is what drives the automatic renewal process. Second, make sure expiry alerts are configured in cPanel under the SSL/TLS Status section, so you get notified if a certificate is approaching its expiry date and renewal has not kicked in as expected. Third, after each renewal cycle completes, go and check the renewal logs — you will find them in the logs folder inside DavWWWRoot — just to confirm everything completed cleanly. And fourth, you should manually verify the certificate chain after renewal. There is a command you can run in your terminal that opens a connection to your domain on the standard HTTPS port and outputs the full certificate details, letting you confirm the certificate is valid, trusted, and presenting correctly to the outside world.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.