diff --git a/dns-records.md b/dns-records.md
new file mode 100644
index 0000000..d854079
--- /dev/null
+++ b/dns-records.md
@@ -0,0 +1,85 @@
+# DNS Records — itpropartner.com
+**Managed by:** SiteGround Site Tools (no API access)
+**Updated:** July 16, 2026
+**⚠️ Germaine must apply changes manually at SiteGround**
+
+## CREATE (pending)
+
+| Subdomain | Record | IP | Service |
+|---|---|---|---|
+| my.itpropartner.com | A | 152.53.192.33 | Customer portal hub |
+| vault.itpropartner.com | A | 152.53.36.131 | Vaultwarden (moving from Core) |
+| status.itpropartner.com | A | 152.53.192.33 | Public status page |
+
+## FIX
+
+| Subdomain | Current IP | Should Be | Reason |
+|---|---|---|---|
+| app1-bu.itpropartner.com | 5.161.114.8 | **5.161.225.131** | Old CPX11 → new CPX21 warm standby |
+
+## PRODUCTION (Netcup — no changes)
+
+| Subdomain | IP | Server | Service |
+|---|---|---|---|
+| ops.itpropartner.com | 152.53.192.33 | Core | Operations dashboard |
+| core.itpropartner.com | 152.53.192.33 | Core | Landing page + MikroTik |
+| sign.itpropartner.com | 152.53.192.33 | Core | Document signing |
+| uptimekuma.itpropartner.com | 152.53.192.33 | Core | Uptime monitoring |
+| app.itpropartner.com | 152.53.192.33 | Core | App entry |
+| admin-ai.itpropartner.com | 152.53.36.131 | app1 | LiteLLM |
+| ai.itpropartner.com | 152.53.36.131 | app1 | Open WebUI |
+| n8n.itpropartner.com | 152.53.36.131 | app1 | Workflow automation |
+| app1.itpropartner.com | 152.53.36.131 | app1 | App server 1 |
+| git.itpropartner.com | 152.53.39.202 | app2 | Gitea |
+| hudu.itpropartner.com | 152.53.39.202 | app2 | Documentation |
+| unifi.itpropartner.com | 152.53.39.202 | app2 | UniFi controller |
+| www.unifi.itpropartner.com | 152.53.39.202 | app2 | UniFi (www) |
+| panel.itpropartner.com | 152.53.241.111 | app3 | CloudPanel |
+
+## DELETE (all point to 35.212.86.161 — old host)
+
+| Subdomain | Notes |
+|---|---|
+| garyjavo.itpropartner.com | Old client site |
+| www.garyjavo.itpropartner.com | Old client site |
+| clientmedia.itpropartner.com | Old project |
+| www.clientmedia.itpropartner.com | Old project |
+| media.itpropartner.com | Old project |
+| www.media.itpropartner.com | Old project |
+| apx.itpropartner.com | Old project |
+| www.apx.itpropartner.com | Old project |
+| ssh.itpropartner.com | Old SSH endpoint |
+| support.itpropartner.com | Moving to my.itpropartner.com |
+| www.support.itpropartner.com | Moving to my.itpropartner.com |
+| mail.itpropartner.com | MXroute handles email |
+| ftp.itpropartner.com | Not used |
+| autodiscover.itpropartner.com | Exchange not used |
+| autoconfig.itpropartner.com | Exchange not used |
+| mainwp.itpropartner.com | Moving to ops |
+
+## Service Routing Plan
+
+### my.itpropartner.com (152.53.192.33) — Customer Hub
+DNS, Digital Signage, Networking, Status, Tech Support, Web Hosting, Marketplace, Phone (→ voipsimplicity.com), Fleet (→ fleettracker360.com)
+
+### ops.itpropartner.com (152.53.192.33) — Technical Hub
+- `/` — Operations Dashboard (port 8090)
+- `/grafana/` — Grafana (Core :3002)
+- `/uptime/` — Uptime Kuma (Core :3001)
+- `/gitea/` — Gitea (app2 :3000)
+- `/n8n/` — n8n (app1 :5678)
+- `/search/` — Super Search / OSINT (app1 :8100)
+- `/noc/` — Mattermost (future, app1)
+
+### core.itpropartner.com (152.53.192.33) — Minimal Landing
+Stripped down — just links to ops, my, and other services. Keep Core lean for Hermes.
+
+### Standalone (no changes)
+- vault.itpropartner.com → 152.53.36.131 (app1, after migration)
+- admin-ai.itpropartner.com → 152.53.36.131 (app1)
+- hudu.itpropartner.com → 152.53.39.202 (app2)
+- panel.itpropartner.com → 152.53.241.111 (app3)
+
+### Other Domains
+- fleettracker360.com → Cloudflare DNS
+- voipsimplicity.com → Cloudflare DNS