diff --git a/flake.lock b/flake.lock
index 05bb18b..6035cb5 100644
--- a/flake.lock
+++ b/flake.lock
@@ -999,6 +999,20 @@
       }
     },
     "flake-compat_10": {
+      "locked": {
+        "lastModified": 1733328505,
+        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "revCount": 69,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.1.0/01948eb7-9cba-704f-bbf3-3fa956735b52/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz"
+      }
+    },
+    "flake-compat_11": {
       "flake": false,
       "locked": {
         "lastModified": 1641205782,
@@ -1014,7 +1028,7 @@
         "type": "github"
       }
     },
-    "flake-compat_11": {
+    "flake-compat_12": {
       "flake": false,
       "locked": {
         "lastModified": 1641205782,
@@ -1030,7 +1044,7 @@
         "type": "github"
       }
     },
-    "flake-compat_12": {
+    "flake-compat_13": {
       "flake": false,
       "locked": {
         "lastModified": 1751685974,
@@ -1140,12 +1154,13 @@
       }
     },
     "flake-compat_8": {
+      "flake": false,
       "locked": {
-        "lastModified": 1767039857,
-        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "lastModified": 1733328505,
+        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
         "type": "github"
       },
       "original": {
@@ -1156,16 +1171,17 @@
     },
     "flake-compat_9": {
       "locked": {
-        "lastModified": 1733328505,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
-        "revCount": 69,
-        "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.1.0/01948eb7-9cba-704f-bbf3-3fa956735b52/source.tar.gz"
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
       },
       "original": {
-        "type": "tarball",
-        "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz"
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
       }
     },
     "flake-parts": {
@@ -1422,7 +1438,7 @@
     },
     "flake-utils_16": {
       "inputs": {
-        "systems": "systems_21"
+        "systems": "systems_22"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -1470,7 +1486,7 @@
     },
     "flake-utils_19": {
       "inputs": {
-        "systems": "systems_23"
+        "systems": "systems_24"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -1506,7 +1522,7 @@
     },
     "flake-utils_20": {
       "inputs": {
-        "systems": "systems_25"
+        "systems": "systems_26"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -1524,7 +1540,7 @@
     },
     "flake-utils_21": {
       "inputs": {
-        "systems": "systems_26"
+        "systems": "systems_27"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -1542,7 +1558,7 @@
     },
     "flake-utils_22": {
       "inputs": {
-        "systems": "systems_28"
+        "systems": "systems_29"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -2771,6 +2787,29 @@
         "type": "github"
       }
     },
+    "nixos-dns": {
+      "inputs": {
+        "flake-compat": "flake-compat_8",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": "systems_19",
+        "treefmt-nix": "treefmt-nix"
+      },
+      "locked": {
+        "lastModified": 1742583654,
+        "narHash": "sha256-aTsLqhW9XD0O37BTJo0u5f0gkk/x4KnZ9sho9hSE6hE=",
+        "owner": "Janik-Haag",
+        "repo": "nixos-dns",
+        "rev": "04b00ea7423c8dbe6e0ea78e4eb96f874a04c543",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Janik-Haag",
+        "repo": "nixos-dns",
+        "type": "github"
+      }
+    },
     "nixos-images": {
       "inputs": {
         "nixos-stable": [
@@ -2800,7 +2839,7 @@
     "nixos-raspberrypi": {
       "inputs": {
         "argononed": "argononed",
-        "flake-compat": "flake-compat_8",
+        "flake-compat": "flake-compat_9",
         "nixos-images": "nixos-images",
         "nixpkgs": "nixpkgs_6"
       },
@@ -2884,14 +2923,14 @@
     },
     "nixpkgs-xr": {
       "inputs": {
-        "flake-compat": "flake-compat_9",
+        "flake-compat": "flake-compat_10",
         "flake-utils": "flake-utils_15",
         "nixpkgs": [
           "nixpkgs"
         ],
         "nvfetcher": "nvfetcher",
-        "systems": "systems_19",
-        "treefmt-nix": "treefmt-nix"
+        "systems": "systems_20",
+        "treefmt-nix": "treefmt-nix_2"
       },
       "locked": {
         "lastModified": 1776998302,
@@ -3073,7 +3112,7 @@
         "nixpkgs": [
           "nixpkgs"
         ],
-        "systems": "systems_20"
+        "systems": "systems_21"
       },
       "locked": {
         "lastModified": 1777236345,
@@ -3116,7 +3155,7 @@
     },
     "norg": {
       "inputs": {
-        "flake-compat": "flake-compat_10",
+        "flake-compat": "flake-compat_11",
         "flake-utils": "flake-utils_17",
         "nixpkgs": "nixpkgs_8"
       },
@@ -3137,7 +3176,7 @@
     },
     "norg-meta": {
       "inputs": {
-        "flake-compat": "flake-compat_11",
+        "flake-compat": "flake-compat_12",
         "flake-utils": "flake-utils_18",
         "nixpkgs": "nixpkgs_9"
       },
@@ -3251,7 +3290,7 @@
         "nixpkgs": [
           "nixpkgs"
         ],
-        "systems": "systems_22"
+        "systems": "systems_23"
       },
       "locked": {
         "lastModified": 1774625180,
@@ -3356,6 +3395,7 @@
         "nix-index-database": "nix-index-database",
         "nix-minecraft": "nix-minecraft",
         "nixify": "nixify",
+        "nixos-dns": "nixos-dns",
         "nixos-raspberrypi": "nixos-raspberrypi",
         "nixpkgs": "nixpkgs_7",
         "nixpkgs-master": "nixpkgs-master",
@@ -3818,7 +3858,7 @@
           "nixpkgs"
         ],
         "nur": "nur_2",
-        "systems": "systems_24",
+        "systems": "systems_25",
         "tinted-kitty": "tinted-kitty",
         "tinted-schemes": "tinted-schemes",
         "tinted-tmux": "tinted-tmux",
@@ -3990,17 +4030,16 @@
     },
     "systems_19": {
       "locked": {
-        "lastModified": 1689347949,
-        "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
         "owner": "nix-systems",
-        "repo": "default-linux",
-        "rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
         "type": "github"
       },
       "original": {
-        "owner": "nix-systems",
-        "repo": "default-linux",
-        "type": "github"
+        "id": "systems",
+        "type": "indirect"
       }
     },
     "systems_2": {
@@ -4020,16 +4059,16 @@
     },
     "systems_20": {
       "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "lastModified": 1689347949,
+        "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
         "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "repo": "default-linux",
+        "rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68",
         "type": "github"
       },
       "original": {
         "owner": "nix-systems",
-        "repo": "default",
+        "repo": "default-linux",
         "type": "github"
       }
     },
@@ -4153,6 +4192,21 @@
         "type": "github"
       }
     },
+    "systems_29": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "systems_3": {
       "locked": {
         "lastModified": 1681028828,
@@ -4262,7 +4316,7 @@
       "inputs": {
         "actor-typeahead-src": "actor-typeahead-src",
         "fenix": "fenix_3",
-        "flake-compat": "flake-compat_12",
+        "flake-compat": "flake-compat_13",
         "gomod2nix": "gomod2nix",
         "htmx-src": "htmx-src",
         "htmx-ws-src": "htmx-ws-src",
@@ -4477,6 +4531,27 @@
       }
     },
     "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixos-dns",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1742370146,
+        "narHash": "sha256-XRE8hL4vKIQyVMDXykFh4ceo3KSpuJF3ts8GKwh5bIU=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "adc195eef5da3606891cedf80c0d9ce2d3190808",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
+    "treefmt-nix_2": {
       "inputs": {
         "nixpkgs": [
           "nixpkgs-xr",
@@ -4518,7 +4593,7 @@
     "vicinae": {
       "inputs": {
         "nixpkgs": "nixpkgs_11",
-        "systems": "systems_27"
+        "systems": "systems_28"
       },
       "locked": {
         "lastModified": 1777243295,
diff --git a/flake.nix b/flake.nix
index e9acc27..25cd975 100644
--- a/flake.nix
+++ b/flake.nix
@@ -193,6 +193,10 @@
       url = "git+ssh://gitea@git.darksailor.dev/servius/kobors";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    nixos-dns = {
+      url = "github:Janik-Haag/nixos-dns";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
     # Pinned source inputs (replace fetchFromGitHub/fetchgit). Update with `nix flake update <name>`.
     bblauncher-src = {
@@ -287,12 +291,15 @@
         hasGui = false;
         isNix = true;
         isServer = true;
+        tailscaleIp = "100.102.64.19";
+        externalIp = "15.235.165.172";
       };
       ryu = mkDevice {
         name = "ryu";
         system = "x86_64-linux";
         user = "servius";
         isNix = true;
+        tailscaleIp = "100.78.171.80";
         monitors = {
           # Gigabyte FO27Q3
           primary = "HDMI-A-1";
@@ -309,6 +316,7 @@
         hasGui = false;
         isNix = true;
         isServer = true;
+        tailscaleIp = "100.87.221.59";
       };
       kuro = mkDevice {
         name = "kuro";
@@ -351,6 +359,14 @@
         if (builtins.hasAttr "monitors" device)
         then device.monitors
         else null;
+      tailscaleIp =
+        if (builtins.hasAttr "tailscaleIp" device)
+        then device.tailscaleIp
+        else null;
+      externalIp =
+        if (builtins.hasAttr "externalIp" device)
+        then device.externalIp
+        else null;
       system = device.system;
       name = device.name;
       user = device.user;
diff --git a/nixos/default.nix b/nixos/default.nix
index d149bc6..54403ba 100644
--- a/nixos/default.nix
+++ b/nixos/default.nix
@@ -29,6 +29,8 @@
           inputs.stylix.nixosModules.stylix
           inputs.headplane.nixosModules.headplane
           inputs.tangled-core.nixosModules.knot
+          inputs.nixos-dns.nixosModules.dns
+          ./dns-shared.nix
 
           ./${device.name}/configuration.nix
           ../home/module.nix
diff --git a/nixos/dns-shared.nix b/nixos/dns-shared.nix
new file mode 100644
index 0000000..1a918fe
--- /dev/null
+++ b/nixos/dns-shared.nix
@@ -0,0 +1,7 @@
+{inputs, ...}: {
+  networking.domains = {
+    enable = true;
+    defaultTTL = 3600;
+    baseDomains."darksailor.dev".a.data = inputs.self.devices.tako.externalIp;
+  };
+}
diff --git a/nixos/ryu/services/caddy.nix b/nixos/ryu/services/caddy.nix
index d3daeb2..af066c2 100644
--- a/nixos/ryu/services/caddy.nix
+++ b/nixos/ryu/services/caddy.nix
@@ -1,8 +1,11 @@
 {
   config,
   pkgs,
+  device,
   ...
 }: {
+  networking.domains.subDomains."code.darksailor.dev".a.data = device.tailscaleIp;
+
   sops = {
     secrets."cloudflare/api_key".owner = config.services.caddy.user;
     templates = {
diff --git a/nixos/ryu/services/ollama.nix b/nixos/ryu/services/ollama.nix
index 0aa96b8..4f537ba 100644
--- a/nixos/ryu/services/ollama.nix
+++ b/nixos/ryu/services/ollama.nix
@@ -2,8 +2,11 @@
   pkgs,
   lib,
   config,
+  device,
   ...
 }: {
+  networking.domains.subDomains."ollama.darksailor.dev".a.data = device.tailscaleIp;
+
   sops = {
     secrets."openai/api_key" = {};
     secrets."llama/api_key".owner = config.services.caddy.user;
diff --git a/nixos/ryu/services/sunshine.nix b/nixos/ryu/services/sunshine.nix
index 63e5297..614cd92 100644
--- a/nixos/ryu/services/sunshine.nix
+++ b/nixos/ryu/services/sunshine.nix
@@ -4,6 +4,8 @@
   config,
   ...
 }: {
+  networking.domains.subDomains."sunshine.darksailor.dev".a.data = device.tailscaleIp;
+
   systemd.user.services.sunshine.path = [
     pkgs.gamemode
     pkgs.steam
diff --git a/nixos/ryu/services/vllm.nix b/nixos/ryu/services/vllm.nix
index a04ffc0..47acbbd 100644
--- a/nixos/ryu/services/vllm.nix
+++ b/nixos/ryu/services/vllm.nix
@@ -2,10 +2,19 @@
   pkgs,
   lib,
   config,
+  inputs,
   ...
 }: let
   port = 3094;
 in {
+  networking.domains.subDomains = {
+    "llama.darksailor.dev".a.data = inputs.self.devices.tako.tailscaleIp;
+    "_acme-challenge.llama.ryu.darksailor.dev" = {
+      a.data = null;
+      txt.data = "KkTY3eRzN0UcXl1pDdAze-Fj6f-xdqTuOMCQSVUl8GM";
+    };
+  };
+
   sops = {
     secrets."llama/api_key".owner = config.services.caddy.user;
     templates = {
diff --git a/nixos/tako/configuration.nix b/nixos/tako/configuration.nix
index cc1d018..b670fcb 100644
--- a/nixos/tako/configuration.nix
+++ b/nixos/tako/configuration.nix
@@ -7,6 +7,7 @@
   imports = [
     # Include the results of the hardware scan.
     ./services
+    ./dns.nix
     ./tako.nix
     # ./docker.nix
     ../../modules/nixos/substituters.nix
diff --git a/nixos/tako/dns.nix b/nixos/tako/dns.nix
new file mode 100644
index 0000000..5afeb53
--- /dev/null
+++ b/nixos/tako/dns.nix
@@ -0,0 +1,70 @@
+{inputs, ...}: let
+  inherit (inputs.self) devices;
+  game = "65.109.106.125";
+  chibi = "51.79.165.197";
+in {
+  # Records that are not associated with a single service live here.
+  # Service-specific records are colocated with their service module.
+  networking.domains.subDomains = {
+    # Apex extras (MX + SPF). A is inherited from baseDomain.
+    "darksailor.dev" = {
+      mx.data = [
+        {
+          preference = 10;
+          exchange = "in1-smtp.messagingengine.com";
+        }
+        {
+          preference = 20;
+          exchange = "in2-smtp.messagingengine.com";
+        }
+      ];
+      txt.data = "v=spf1 include:spf.messagingengine.com -all";
+    };
+
+    # Wildcards.
+    "*.darksailor.dev" = {};
+    "*.ryu.darksailor.dev".a.data = devices.ryu.tailscaleIp;
+    "*.tsuba.darksailor.dev".a.data = devices.tsuba.tailscaleIp;
+
+    # Host records (Tailscale).
+    "ryu.darksailor.dev".a.data = devices.ryu.tailscaleIp;
+    "tako.darksailor.dev".a.data = devices.tako.tailscaleIp;
+    "tsuba.darksailor.dev".a.data = devices.tsuba.tailscaleIp;
+
+    # External hosts (no service file).
+    "chibi.darksailor.dev".a.data = chibi;
+    "game.darksailor.dev".a.data = game;
+
+    # Records without a corresponding service module in this repo.
+    "console.darksailor.dev" = {};
+    "langfuse.darksailor.dev" = {};
+    "mc.darksailor.dev" = {};
+    "notes.darksailor.dev" = {};
+    "sh.darksailor.dev" = {};
+    "www.darksailor.dev" = {};
+
+    # DKIM CNAMEs (no inherited A/AAAA).
+    "fm1._domainkey.darksailor.dev" = {
+      a.data = null;
+      cname.data = "fm1.darksailor.dev.dkim.fmhosted.com";
+    };
+    "fm2._domainkey.darksailor.dev" = {
+      a.data = null;
+      cname.data = "fm2.darksailor.dev.dkim.fmhosted.com";
+    };
+    "fm3._domainkey.darksailor.dev" = {
+      a.data = null;
+      cname.data = "fm3.darksailor.dev.dkim.fmhosted.com";
+    };
+
+    # Auth/policy TXT records (no inherited A).
+    "_atproto.darksailor.dev" = {
+      a.data = null;
+      txt.data = "did=did:plc:tllyvpa5oxw6fwwhkj3kv6dr";
+    };
+    "_dmarc.darksailor.dev" = {
+      a.data = null;
+      txt.data = "v=DMARC1; p=reject; rua=mailto:dmarc@darksailor.dev; adkim=s; aspf=s";
+    };
+  };
+}
diff --git a/nixos/tako/services/atuin.nix b/nixos/tako/services/atuin.nix
index 475e2b4..c53c931 100644
--- a/nixos/tako/services/atuin.nix
+++ b/nixos/tako/services/atuin.nix
@@ -1,4 +1,5 @@
 {...}: {
+  networking.domains.subDomains."atuin.darksailor.dev" = {};
   services = {
     atuin = {
       enable = true;
diff --git a/nixos/tako/services/authelia.nix b/nixos/tako/services/authelia.nix
index 9be1a39..c519846 100644
--- a/nixos/tako/services/authelia.nix
+++ b/nixos/tako/services/authelia.nix
@@ -1,6 +1,7 @@
 {config, ...}: let
   port = 5555;
 in {
+  networking.domains.subDomains."auth.darksailor.dev" = {};
   sops = {
     secrets = let
       user = config.systemd.services.authelia-darksailor.serviceConfig.User;
diff --git a/nixos/tako/services/default.nix b/nixos/tako/services/default.nix
index 031ac88..d384ee3 100644
--- a/nixos/tako/services/default.nix
+++ b/nixos/tako/services/default.nix
@@ -27,6 +27,7 @@
     ./llms.nix
     ./matrix
     ./monitoring.nix
+    ./octodns.nix
     # ./servius-website.nix
     # ./paperless.nix
     ./prowlarr.nix
diff --git a/nixos/tako/services/excalidraw.nix b/nixos/tako/services/excalidraw.nix
index 8a8dbef..6689d83 100644
--- a/nixos/tako/services/excalidraw.nix
+++ b/nixos/tako/services/excalidraw.nix
@@ -2,6 +2,8 @@
   dataDir = "/var/lib/excalidraw";
   base_domain = "darksailor.dev";
 in {
+  networking.domains.subDomains."draw.${base_domain}" = {};
+
   # SOPS secrets and templates
   sops = {
     secrets = {
diff --git a/nixos/tako/services/gitea.nix b/nixos/tako/services/gitea.nix
index 1a524aa..6aa29ef 100644
--- a/nixos/tako/services/gitea.nix
+++ b/nixos/tako/services/gitea.nix
@@ -4,6 +4,8 @@
   pkgs,
   ...
 }: {
+  networking.domains.subDomains."git.darksailor.dev" = {};
+
   virtualisation.docker.enable = true;
   sops = {
     # secrets."gitea/registration".owner = config.systemd.services.gitea-actions-tako.serviceConfig.User;
diff --git a/nixos/tako/services/harmonia.nix b/nixos/tako/services/harmonia.nix
index c0d0862..62511ec 100644
--- a/nixos/tako/services/harmonia.nix
+++ b/nixos/tako/services/harmonia.nix
@@ -1,6 +1,8 @@
 {config, ...}: let
   address = "127.0.0.1:8052";
 in {
+  networking.domains.subDomains."cache.darksailor.dev" = {};
+
   sops.secrets."harmonia/sign_key" = {};
 
   services = {
diff --git a/nixos/tako/services/headscale.nix b/nixos/tako/services/headscale.nix
index b46af89..6ec54c3 100644
--- a/nixos/tako/services/headscale.nix
+++ b/nixos/tako/services/headscale.nix
@@ -1,4 +1,6 @@
 {config, ...}: {
+  networking.domains.subDomains."headscale.darksailor.dev" = {};
+
   sops = {
     secrets.headscale-secret = {
       owner = config.systemd.services.headscale.serviceConfig.User;
diff --git a/nixos/tako/services/homepage.nix b/nixos/tako/services/homepage.nix
index 71dc453..c1d530b 100644
--- a/nixos/tako/services/homepage.nix
+++ b/nixos/tako/services/homepage.nix
@@ -1,4 +1,6 @@
 {config, ...}: {
+  networking.domains.subDomains."dashboard.darksailor.dev" = {};
+
   services = {
     homepage-dashboard = {
       enable = true;
diff --git a/nixos/tako/services/immich.nix b/nixos/tako/services/immich.nix
index b8516b9..dd6438e 100644
--- a/nixos/tako/services/immich.nix
+++ b/nixos/tako/services/immich.nix
@@ -3,6 +3,8 @@
   config,
   ...
 }: {
+  networking.domains.subDomains."photos.darksailor.dev" = {};
+
   sops = {
     secrets."authelia/oidc/immich/client_id" = {
       owner = config.systemd.services.authelia-darksailor.serviceConfig.User;
diff --git a/nixos/tako/services/kellnr.nix b/nixos/tako/services/kellnr.nix
index c9f5706..99e064d 100644
--- a/nixos/tako/services/kellnr.nix
+++ b/nixos/tako/services/kellnr.nix
@@ -7,6 +7,8 @@
   port = 8899;
   domain = "crates.darksailor.dev";
 in {
+  networking.domains.subDomains.${domain} = {};
+
   sops = {
     secrets."kellnr/password" = {};
     secrets."kellnr/token" = {};
diff --git a/nixos/tako/services/komga.nix b/nixos/tako/services/komga.nix
index 184bf6a..d6c820d 100644
--- a/nixos/tako/services/komga.nix
+++ b/nixos/tako/services/komga.nix
@@ -1,6 +1,12 @@
-{config, ...}: let
+{
+  config,
+  device,
+  ...
+}: let
   port = 25600;
 in {
+  networking.domains.subDomains."comics.darksailor.dev".a.data = device.tailscaleIp;
+
   systemd.tmpfiles.rules = [
     "Z /media/comics - ${config.services.komga.user} ${config.services.komga.group} - -"
   ];
diff --git a/nixos/tako/services/lldap.nix b/nixos/tako/services/lldap.nix
index 321ec4a..db07440 100644
--- a/nixos/tako/services/lldap.nix
+++ b/nixos/tako/services/lldap.nix
@@ -1,8 +1,14 @@
 {
   config,
   lib,
+  device,
   ...
 }: {
+  networking.domains.subDomains = {
+    "ldap.darksailor.dev" = {};
+    "lldap.darksailor.dev".a.data = device.tailscaleIp;
+  };
+
   services.lldap = {
     enable = true;
     settings = {
diff --git a/nixos/tako/services/llms.nix b/nixos/tako/services/llms.nix
index 2f6fb2f..a14806d 100644
--- a/nixos/tako/services/llms.nix
+++ b/nixos/tako/services/llms.nix
@@ -1,4 +1,6 @@
 {config, ...}: {
+  networking.domains.subDomains."chat.darksailor.dev" = {};
+
   sops = {
     secrets."llama/api_key".owner = config.services.caddy.user;
     secrets."openai/api_key" = {};
diff --git a/nixos/tako/services/matrix/tuwunel.nix b/nixos/tako/services/matrix/tuwunel.nix
index e82bfe3..a05b2dd 100644
--- a/nixos/tako/services/matrix/tuwunel.nix
+++ b/nixos/tako/services/matrix/tuwunel.nix
@@ -10,6 +10,13 @@
   rtc_domain = "matrix-rtc.${base_domain}";
   jwt_port = 8081;
 in {
+  networking.domains.subDomains = {
+    "matrix.${base_domain}" = {};
+    ${rtc_domain} = {};
+    "livekit.${base_domain}" = {};
+    "turn.${base_domain}" = {};
+  };
+
   sops = {
     secrets."tuwunel/client_id" = {
       owner = config.services.matrix-tuwunel.user;
diff --git a/nixos/tako/services/monitoring.nix b/nixos/tako/services/monitoring.nix
index 45e9709..089058d 100644
--- a/nixos/tako/services/monitoring.nix
+++ b/nixos/tako/services/monitoring.nix
@@ -2,6 +2,7 @@
   config,
   pkgs,
   lib,
+  device,
   ...
 }: let
   # Port configurations
@@ -23,6 +24,11 @@
     caddy = 2019;
   };
 in {
+  networking.domains.subDomains = {
+    "monitoring.darksailor.dev" = {};
+    "grafana.darksailor.dev".a.data = device.tailscaleIp;
+  };
+
   sops.secrets."grafana/secret_key" = {
     owner = "grafana";
   };
diff --git a/nixos/tako/services/navidrome.nix b/nixos/tako/services/navidrome.nix
index 776b077..40ca74b 100644
--- a/nixos/tako/services/navidrome.nix
+++ b/nixos/tako/services/navidrome.nix
@@ -5,6 +5,8 @@
 }: let
   socket = "/run/navidrome/navidrome.sock";
 in {
+  networking.domains.subDomains."music.darksailor.dev" = {};
+
   sops = {
     secrets."lastfm/api_key" = {};
     secrets."lastfm/shared_secret" = {};
diff --git a/nixos/tako/services/nextcloud.nix b/nixos/tako/services/nextcloud.nix
index 0bdf1f6..374f197 100644
--- a/nixos/tako/services/nextcloud.nix
+++ b/nixos/tako/services/nextcloud.nix
@@ -3,6 +3,8 @@
   pkgs,
   ...
 }: {
+  networking.domains.subDomains."cloud.darksailor.dev" = {};
+
   sops = {
     secrets."nextcloud/adminpass".owner = config.users.users.nextcloud.name;
     # secrets."authelia/oidc/nextcloud/client_id".owner = config.users.users.nextcloud.name;
diff --git a/nixos/tako/services/octodns.nix b/nixos/tako/services/octodns.nix
new file mode 100644
index 0000000..61ca7af
--- /dev/null
+++ b/nixos/tako/services/octodns.nix
@@ -0,0 +1,64 @@
+{
+  config,
+  inputs,
+  pkgs,
+  ...
+}: let
+  generate = inputs.nixos-dns.utils.generate pkgs;
+  dnsConfig = {
+    inherit (inputs.self) nixosConfigurations;
+    extraConfig = {};
+  };
+  octodnsConfigFile = generate.octodnsConfig {
+    inherit dnsConfig;
+    config = {
+      providers.cloudflare = {
+        class = "octodns_cloudflare.CloudflareProvider";
+        cf_token = "env/CLOUDFLARE_TOKEN";
+      };
+    };
+    zones = {
+      "darksailor.dev." = inputs.nixos-dns.utils.octodns.generateZoneAttrs ["cloudflare"];
+    };
+  };
+  octodnsPkg = pkgs.octodns.withProviders (ps: [
+    pkgs.octodns-providers.cloudflare
+    pkgs.octodns-providers.bind
+  ]);
+  syncCmd = mode: "${octodnsPkg}/bin/octodns-sync --config-file ${octodnsConfigFile} ${mode}";
+in {
+  sops.secrets."cloudflare/darksailor_dev_api_key" = {};
+
+  sops.templates."octodns.env".content = ''
+    CLOUDFLARE_TOKEN=${config.sops.placeholder."cloudflare/darksailor_dev_api_key"}
+  '';
+
+  systemd.services.octodns-plan = {
+    description = "OctoDNS drift detection (read-only)";
+    serviceConfig = {
+      Type = "oneshot";
+      EnvironmentFile = config.sops.templates."octodns.env".path;
+      ExecStart = syncCmd "";
+    };
+  };
+
+  systemd.services.octodns-apply = {
+    description = "OctoDNS apply zone to Cloudflare";
+    serviceConfig = {
+      Type = "oneshot";
+      EnvironmentFile = config.sops.templates."octodns.env".path;
+      ExecStart = syncCmd "--doit --force";
+    };
+  };
+
+  # Enable once `networking.domains` declarations cover the real zone, otherwise
+  # plan output is dominated by spurious deletes for unmodelled records.
+  # systemd.timers.octodns-plan = {
+  #   description = "Hourly OctoDNS drift detection";
+  #   wantedBy = ["timers.target"];
+  #   timerConfig = {
+  #     OnCalendar = "hourly";
+  #     Persistent = true;
+  #   };
+  # };
+}
diff --git a/nixos/tako/services/prowlarr.nix b/nixos/tako/services/prowlarr.nix
index caa944c..dd9954c 100644
--- a/nixos/tako/services/prowlarr.nix
+++ b/nixos/tako/services/prowlarr.nix
@@ -3,6 +3,8 @@
   masterPkgs,
   ...
 }: {
+  networking.domains.subDomains."prowlarr.darksailor.dev" = {};
+
   services = {
     prowlarr = {
       enable = true;
diff --git a/nixos/tako/services/searxng.nix b/nixos/tako/services/searxng.nix
index 77368b2..27e48b8 100644
--- a/nixos/tako/services/searxng.nix
+++ b/nixos/tako/services/searxng.nix
@@ -3,6 +3,8 @@
   pkgs,
   ...
 }: {
+  networking.domains.subDomains."search.darksailor.dev" = {};
+
   systemd.services.websurfx = {
     description = "Websurfx";
     wantedBy = ["multi-user.target"];
diff --git a/nixos/tsuba/default.nix b/nixos/tsuba/default.nix
index d4b6a51..5714612 100644
--- a/nixos/tsuba/default.nix
+++ b/nixos/tsuba/default.nix
@@ -50,6 +50,8 @@
               ];
             };
           }
+          inputs.nixos-dns.nixosModules.dns
+          ../dns-shared.nix
           ./configuration.nix
           ./services
           ./programs
diff --git a/nixos/tsuba/services/esphome.nix b/nixos/tsuba/services/esphome.nix
index 74042da..d4d1fc3 100644
--- a/nixos/tsuba/services/esphome.nix
+++ b/nixos/tsuba/services/esphome.nix
@@ -1,5 +1,11 @@
 # https://wiki.seeedstudio.com/getting_started_with_reterminal_e1002
-{config, ...}: {
+{
+  config,
+  device,
+  ...
+}: {
+  networking.domains.subDomains."esphome.darksailor.dev".a.data = device.tailscaleIp;
+
   sops.secrets.esphome = {
     sopsFile = ../../../secrets/esphome.yaml;
     format = "yaml";
diff --git a/nixos/tsuba/services/homeassistant.nix b/nixos/tsuba/services/homeassistant.nix
index 15d1dbd..30869d1 100644
--- a/nixos/tsuba/services/homeassistant.nix
+++ b/nixos/tsuba/services/homeassistant.nix
@@ -2,8 +2,14 @@
   pkgs,
   lib,
   config,
+  device,
   ...
 }: {
+  networking.domains.subDomains = {
+    "home.darksailor.dev".a.data = device.tailscaleIp;
+    "puppet.home.darksailor.dev".a.data = device.tailscaleIp;
+  };
+
   sops.secrets."homeassistant/puppet-token" = {};
   sops.templates."puppet-options.json".content = builtins.toJSON {
     home_assistant_url = "http://host.docker.internal:8123";
diff --git a/nixos/tsuba/services/jellyfin.nix b/nixos/tsuba/services/jellyfin.nix
index 5dbc10c..10f96f9 100644
--- a/nixos/tsuba/services/jellyfin.nix
+++ b/nixos/tsuba/services/jellyfin.nix
@@ -1,8 +1,11 @@
 {
   pkgs,
   config,
+  device,
   ...
 }: {
+  networking.domains.subDomains."jellyfin.darksailor.dev".a.data = device.tailscaleIp;
+
   virtualisation.oci-containers = {
     containers = {
       jellyfin = {
diff --git a/nixos/tsuba/services/pihole.nix b/nixos/tsuba/services/pihole.nix
index b9aac98..d6c892b 100644
--- a/nixos/tsuba/services/pihole.nix
+++ b/nixos/tsuba/services/pihole.nix
@@ -1,8 +1,11 @@
 {
   pkgs,
   config,
+  device,
   ...
 }: {
+  networking.domains.subDomains."pihole.darksailor.dev".a.data = device.tailscaleIp;
+
   sops = {
     secrets."pihole/password" = {};
     templates."pihole.env".content = ''