app.paycargo.ai, obs.paycargo.ai and no-reply@paycargo.aiThe AI platform runs in AWS account 753974371195. Today it is reached on CloudFront's default addresses. These records give it permanent PayCargo addresses and let it send system email (sign-in invites, password resets) as no-reply@paycargo.ai:
app.paycargo.ai → the Console (the platform shell people sign in to)obs.paycargo.ai → obs (operators: tenants, users, health, docs)no-reply@paycargo.ai → sent by Amazon SES. The whole domain is verified by DKIM, so no mailbox is needed.DNS for paycargo.ai is hosted at GoDaddy (ns67/ns68.domaincontrol.com). Names below are in GoDaddy's format — without .paycargo.ai on the end. TTL 300 (or GoDaddy's default) for all. It is safe to add all 11 at once.
AWS Certificate Manager proves we own each address through these. It renews the certificates every year off the same records, so never delete them.
| Type | Name (GoDaddy) | Value |
|---|---|---|
CNAME | _0f9a74d22234e0b3cc79e38d3329add2.app | _0f496946b3b6d0fb2a3eb991b2d5e19b.wzccmgtwzk.acm-validations.aws. |
CNAME | _f15014f1fa1756b448131cb4831e02f0.obs | _0944314c4d59d65ccd1a3d6ccf71d84f.wzccmgtwzk.acm-validations.aws. |
Until our cutover apply attaches the addresses, these return a CloudFront error page — nobody uses them yet, so adding them early is harmless.
| Type | Name (GoDaddy) | Value |
|---|---|---|
CNAME | app | d3m6zyvaoy8jck.cloudfront.net |
CNAME | obs | d156lhaifyr7ay.cloudfront.net |
no-reply@paycargo.ai via Amazon SES| Type | Name (GoDaddy) | Value |
|---|---|---|
TXT | _amazonses | mCdnQZba6qW3UtKTt09nzbxNlCaH05SrmqhklOnMtS4= |
CNAME | hfw4cl2ys4zyc45nrz7cjxqeguk2q4dp._domainkey | hfw4cl2ys4zyc45nrz7cjxqeguk2q4dp.dkim.amazonses.com |
CNAME | tikckapdjopqpfr4rhvzsxsbnjtwnj3r._domainkey | tikckapdjopqpfr4rhvzsxsbnjtwnj3r.dkim.amazonses.com |
CNAME | gli7gkpoqrecqba26i6tgfmmbukasyjx._domainkey | gli7gkpoqrecqba26i6tgfmmbukasyjx.dkim.amazonses.com |
MX | mail | 10 feedback-smtp.us-east-1.amazonses.com |
TXT | mail | v=spf1 include:amazonses.com -all |
TXT | _dmarc | v=DMARC1; p=none; pct=100 |
paycargo.ai itself, on purpose. One saying only Amazon may send would block any other email service the domain adds later (e.g. company mail). DKIM plus the SPF on mail.paycargo.ai are enough for receiving servers to trust our mail.p=none with no report address — paycargo.ai has no mailbox yet. Add rua=mailto:… once one exists, and tighten the policy once delivery is proven.paycargo.ai shows verified in SES.terraform apply attaches both addresses, redirects the old CloudFront addresses to them, adds them to sign-in, and switches sign-in email to no-reply@paycargo.ai.app.paycargo.ai, open obs.paycargo.ai, and send a test invite.Rollback: remove the app/obs CNAMEs and revert the hostnames in terraform.tfvars; the CloudFront default addresses keep working throughout.
All values are Terraform outputs in substrate/environments/ai-sandbox: dns_admin_paycargo_io_records and dns_admin_paycargo_io_records_obs (certificates — the output names predate the move to .ai) and dns_admin_ses_records (email). If a certificate is ever re-requested, its validation record changes: re-read the output, don't reuse this page.
Questions or edge cases: Mike Tang, mtang@paycargo.com, or comment on the GitHub issue.