Point your domain at the instance (optional)

navigator ops gcp setup reserves a static gateway IP but deliberately does not touch DNS. Keep this boundary: do not put the DNSimple token in any deployment's tree, and do not make DNS a side effect of GCP provisioning. Apply this one reviewed transaction directly with the DNSimple CLI.

The exact one-time transaction below is the three-deployment record set: one public and one workflow address per deployment. Review current state before applying it and omit any create whose exact record already exists. The apex continues to redirect neonlaw.com to https://www.neonlaw.com.

This block is the pre-cutover neonlaw.com record set and has not been rewritten for the host map above. It records the single-zone state live in DNSimple today, including the exact record ids its preflight compares against, so it is reproduced verbatim rather than machine-edited. Moving the firm's production to www.neonlaw.com and Neon production to www.neonlaw.com splits this one zone into three, and each new zone needs its own registration, records, managed certificate, and OAuth redirect URI before any record here is deleted. Treat the block below as the state to migrate from.

export DNS_ACCT=174981
export DNSIMPLE_TOKEN="$DNS_SIMPLE"

dnsimple records list neonlaw.com --account "$DNS_ACCT" --json |
  jq --exit-status '
    .data as $records |
      ([$records[] | select(.name == "" and .type == "URL")] == [{
        id: 80303423,
        zone_id: "neonlaw.com",
        type: "URL",
        name: "",
        content: "https://www.neonlaw.com",
        ttl: 300,
        regions: ["global"],
        created_at: "2026-07-23T22:08:37Z",
        updated_at: "2026-07-23T22:08:37Z"
      }]) and
      ([$records[] |
        select(
          .name == "staging" or
          .name == "workflows-staging" or
          .name == "neon" or
          .name == "workflows-neon-law-prod" or
          .name == "www" or
          .name == "workflows"
        )
      ] == [{
        id: 80303569,
        zone_id: "neonlaw.com",
        type: "URL",
        name: "www",
        content: "https://www.neonlaw.com",
        ttl: 300,
        regions: ["global"],
        created_at: "2026-07-23T22:14:28Z",
        updated_at: "2026-07-23T22:14:28Z"
      }])
  '

dnsimple records delete neonlaw.com 80303569 --account "$DNS_ACCT" --yes

dnsimple records create neonlaw.com --account "$DNS_ACCT" --type A --name staging \
  --content 34.160.169.219 --ttl 300
dnsimple records create neonlaw.com --account "$DNS_ACCT" --type A --name workflows-staging \
  --content 34.160.169.219 --ttl 300
dnsimple records create neonlaw.com --account "$DNS_ACCT" --type A --name neon \
  --content 34.149.196.255 --ttl 300
dnsimple records create neonlaw.com --account "$DNS_ACCT" --type A --name workflows-neon-law-prod \
  --content 34.149.196.255 --ttl 300
dnsimple records create neonlaw.com --account "$DNS_ACCT" --type A --name www \
  --content 8.233.220.29 --ttl 300
dnsimple records create neonlaw.com --account "$DNS_ACCT" --type A --name workflows \
  --content 8.233.220.29 --ttl 300

The provider-side record list and a public resolver must return all six paired addresses after the transaction. The apex returned 301 https://www.neonlaw.com/. The temporary token was then removed from the shell and can be revoked in DNSimple; record serving and propagation do not depend on it.

Run the mail record groups once for the neonlaw.com zone—not once per deployment—using --google-workspace, --sendgrid, DKIM/link-branding targets, SPF includes, and DMARC settings. The command is additive and never deletes unrelated records. The full record ownership and Google Workspace forwarding recipe is in docs/dns.md.