diff --git a/dns-records.md b/dns-records.md
index a5f51b3..e920241 100644
--- a/dns-records.md
+++ b/dns-records.md
@@ -7,6 +7,10 @@
 
 | Subdomain | Record | IP | Service |
 |---|---|---|---|
+| voipsimplicity.itpropartner.com | A | 152.53.192.33 | VoIPSimplicity static portal (Core, deployed 2026-08-18) |
+| forefront.itpropartner.com | A | 152.53.192.33 | Forefront Wireless static portal (Core, deployed 2026-08-18) |
+
+**After applying these two records:** remove the `tls internal` line from both blocks in `/etc/caddy/Caddyfile` on Core and reload (`caddy validate` first, then `systemctl reload caddy`) so Let's Encrypt certs auto-provision. Sites currently verify 200 only with `--resolve` since DNS is absent.
 
 ## FIX