diff --git a/terraform/0rng.one.tf b/terraform/0rng.one.tf
index 137496f..7a05a16 100644
--- a/terraform/0rng.one.tf
+++ b/terraform/0rng.one.tf
@@ -8,7 +8,7 @@ resource "gandi_livedns_record" "orngone_apex" {
   type = "ALIAS" # Gandi doesn't support CNAME-flattening
   ttl  = 3600
   values = [
-    cloudflare_record.sys_domain_pve.hostname
+    gandi_livedns_record.sys_domain_pve.href
   ]
 }
 
diff --git a/terraform/casey_vps.tf b/terraform/casey_vps.tf
index a042b7b..1cb167a 100644
--- a/terraform/casey_vps.tf
+++ b/terraform/casey_vps.tf
@@ -96,10 +96,10 @@ resource "linode_firewall" "casey" {
 
 resource "linode_rdns" "casey_reverse_ipv4" {
   address = linode_instance.casey.ip_address
-  rdns    = cloudflare_record.sys_domain_casey.hostname
+  rdns    = gandi_livedns_record.sys_domain_casey.href
 }
 
 resource "linode_rdns" "casey_reverse_ipv6" {
   address = split("/", linode_instance.casey.ipv6)[0]
-  rdns    = cloudflare_record.sys_domain_casey.hostname
+  rdns    = gandi_livedns_record.sys_domain_casey.href
 }
diff --git a/terraform/jakehoward.tech.tf b/terraform/jakehoward.tech.tf
index aad522e..2469b30 100644
--- a/terraform/jakehoward.tech.tf
+++ b/terraform/jakehoward.tech.tf
@@ -130,7 +130,7 @@ resource "cloudflare_record" "jakehowardtech_dmarc" {
 resource "cloudflare_record" "jakehowardtech_wallabag" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "wallabag"
-  value   = cloudflare_record.sys_domain_pve.hostname
+  value   = gandi_livedns_record.sys_domain_pve.href
   type    = "CNAME"
   ttl     = 1
 }
@@ -138,7 +138,7 @@ resource "cloudflare_record" "jakehowardtech_wallabag" {
 resource "cloudflare_record" "jakehowardtech_ttrss" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "tt-rss"
-  value   = cloudflare_record.sys_domain_pve.hostname
+  value   = gandi_livedns_record.sys_domain_pve.href
   type    = "CNAME"
   ttl     = 1
 }
@@ -146,7 +146,7 @@ resource "cloudflare_record" "jakehowardtech_ttrss" {
 resource "cloudflare_record" "jakehowardtech_speed" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "speed"
-  value   = cloudflare_record.sys_domain_pve.hostname
+  value   = gandi_livedns_record.sys_domain_pve.href
   type    = "CNAME"
   ttl     = 1
 }
@@ -154,7 +154,7 @@ resource "cloudflare_record" "jakehowardtech_speed" {
 resource "cloudflare_record" "jakehowardtech_quassel" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "quassel"
-  value   = cloudflare_record.sys_domain_pve.hostname
+  value   = gandi_livedns_record.sys_domain_pve.href
   type    = "CNAME"
   ttl     = 1
 }
@@ -162,7 +162,7 @@ resource "cloudflare_record" "jakehowardtech_quassel" {
 resource "cloudflare_record" "jakehowardtech_media" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "media"
-  value   = cloudflare_record.sys_domain_pve.hostname
+  value   = gandi_livedns_record.sys_domain_pve.href
   type    = "CNAME"
   ttl     = 1
 }
@@ -170,7 +170,7 @@ resource "cloudflare_record" "jakehowardtech_media" {
 resource "cloudflare_record" "jakehowardtech_matrix" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "matrix"
-  value   = cloudflare_record.sys_domain_pve.hostname
+  value   = gandi_livedns_record.sys_domain_pve.href
   type    = "CNAME"
   ttl     = 1
 }
@@ -178,7 +178,7 @@ resource "cloudflare_record" "jakehowardtech_matrix" {
 resource "cloudflare_record" "jakehowardtech_intersect" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "intersect"
-  value   = cloudflare_record.sys_domain_pve.hostname
+  value   = gandi_livedns_record.sys_domain_pve.href
   type    = "CNAME"
   ttl     = 1
 }
@@ -186,7 +186,7 @@ resource "cloudflare_record" "jakehowardtech_intersect" {
 resource "cloudflare_record" "jakehowardtech_calibre" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "calibre"
-  value   = cloudflare_record.sys_domain_pve.hostname
+  value   = gandi_livedns_record.sys_domain_pve.href
   type    = "CNAME"
   ttl     = 1
 }
@@ -194,7 +194,7 @@ resource "cloudflare_record" "jakehowardtech_calibre" {
 resource "cloudflare_record" "jakehowardtech_homeassistant" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "homeassistant"
-  value   = cloudflare_record.sys_domain_pve_private.hostname
+  value   = gandi_livedns_record.sys_domain_pve_private.href
   type    = "CNAME"
   ttl     = 1
 }
@@ -202,7 +202,7 @@ resource "cloudflare_record" "jakehowardtech_homeassistant" {
 resource "cloudflare_record" "jakehowardtech_grafana" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "grafana"
-  value   = cloudflare_record.sys_domain_pve.hostname
+  value   = gandi_livedns_record.sys_domain_pve.href
   type    = "CNAME"
   ttl     = 1
 }
@@ -210,7 +210,7 @@ resource "cloudflare_record" "jakehowardtech_grafana" {
 resource "cloudflare_record" "jakehowardtech_vaultwarden" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "vaultwarden"
-  value   = cloudflare_record.sys_domain_pve_private.hostname
+  value   = gandi_livedns_record.sys_domain_pve_private.href
   type    = "CNAME"
   ttl     = 1
 }
@@ -218,7 +218,7 @@ resource "cloudflare_record" "jakehowardtech_vaultwarden" {
 resource "cloudflare_record" "jakehowardtech_tandoor" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "recipes"
-  value   = cloudflare_record.sys_domain_pve.hostname
+  value   = gandi_livedns_record.sys_domain_pve.href
   type    = "CNAME"
   ttl     = 1
 }
@@ -250,7 +250,7 @@ resource "cloudflare_record" "jakehowardtech_mailgun_dmarc" {
 resource "cloudflare_record" "jakehowardtech_matrix_admin" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "synapse-admin"
-  value   = cloudflare_record.sys_domain_pve.hostname
+  value   = gandi_livedns_record.sys_domain_pve.href
   type    = "CNAME"
   ttl     = 1
 }
@@ -259,7 +259,7 @@ resource "cloudflare_record" "jakehowardtech_matrix_admin" {
 resource "cloudflare_record" "jakehowardtech_apex" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "@"
-  value   = cloudflare_record.sys_domain_walker.hostname
+  value   = gandi_livedns_record.sys_domain_walker.href
   type    = "CNAME"
   ttl     = 1
 }
@@ -267,7 +267,7 @@ resource "cloudflare_record" "jakehowardtech_apex" {
 resource "cloudflare_record" "jakehowardtech_collabora" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "collabora"
-  value   = cloudflare_record.sys_domain_pve.hostname
+  value   = gandi_livedns_record.sys_domain_pve.href
   type    = "CNAME"
   ttl     = 1
 }
@@ -275,7 +275,7 @@ resource "cloudflare_record" "jakehowardtech_collabora" {
 resource "cloudflare_record" "jakehowardtech_tasks" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "tasks"
-  value   = cloudflare_record.sys_domain_pve.hostname
+  value   = gandi_livedns_record.sys_domain_pve.href
   type    = "CNAME"
   ttl     = 1
 }
@@ -283,7 +283,7 @@ resource "cloudflare_record" "jakehowardtech_tasks" {
 resource "cloudflare_record" "jakehowardtech_auth" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "auth"
-  value   = cloudflare_record.sys_domain_pve.hostname
+  value   = gandi_livedns_record.sys_domain_pve.href
   type    = "CNAME"
   ttl     = 1
 }
@@ -291,7 +291,7 @@ resource "cloudflare_record" "jakehowardtech_auth" {
 resource "cloudflare_record" "jakehowardtech_minio" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "minio"
-  value   = cloudflare_record.sys_domain_pve.hostname
+  value   = gandi_livedns_record.sys_domain_pve.href
   type    = "CNAME"
   ttl     = 1
 }
@@ -299,7 +299,7 @@ resource "cloudflare_record" "jakehowardtech_minio" {
 resource "cloudflare_record" "jakehowardtech_s3" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "s3"
-  value   = cloudflare_record.sys_domain_pve.hostname
+  value   = gandi_livedns_record.sys_domain_pve.href
   type    = "CNAME"
   ttl     = 1
 }
@@ -307,7 +307,7 @@ resource "cloudflare_record" "jakehowardtech_s3" {
 resource "cloudflare_record" "jakehowardtech_ntfy" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "ntfy"
-  value   = cloudflare_record.sys_domain_pve.hostname
+  value   = gandi_livedns_record.sys_domain_pve.href
   type    = "CNAME"
   ttl     = 1
 }
@@ -315,7 +315,7 @@ resource "cloudflare_record" "jakehowardtech_ntfy" {
 resource "cloudflare_record" "jakehowardtech_headscale" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "headscale"
-  value   = cloudflare_record.sys_domain_casey.hostname
+  value   = gandi_livedns_record.sys_domain_casey.href
   type    = "CNAME"
   ttl     = 1
 }
@@ -323,7 +323,7 @@ resource "cloudflare_record" "jakehowardtech_headscale" {
 resource "cloudflare_record" "jakehowardtech_slides" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "slides"
-  value   = cloudflare_record.sys_domain_walker.hostname
+  value   = gandi_livedns_record.sys_domain_walker.href
   type    = "CNAME"
   ttl     = 1
 }
@@ -331,7 +331,7 @@ resource "cloudflare_record" "jakehowardtech_slides" {
 resource "cloudflare_record" "jakehowardtech_uptime" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "uptime"
-  value   = cloudflare_record.sys_domain_pve.hostname
+  value   = gandi_livedns_record.sys_domain_pve.href
   type    = "CNAME"
   ttl     = 1
 }
diff --git a/terraform/sys_domains.tf b/terraform/sys_domains.tf
index 95570b0..d911cee 100644
--- a/terraform/sys_domains.tf
+++ b/terraform/sys_domains.tf
@@ -1,47 +1,59 @@
-resource "cloudflare_record" "sys_domain_casey" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "casey.sys"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
-  ttl     = 1
+resource "gandi_livedns_record" "sys_domain_casey" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "casey.sys"
+  type = "A"
+  ttl  = 3600
+  values = [
+    linode_instance.casey.ip_address
+  ]
 }
 
-resource "cloudflare_record" "sys_domain_walker" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "walker.sys"
-  value   = hcloud_server.walker.ipv4_address
-  type    = "A"
-  ttl     = 1
+resource "gandi_livedns_record" "sys_domain_casey_v6" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "casey.sys"
+  type = "AAAA"
+  ttl  = 3600
+  values = [
+    split("/", linode_instance.casey.ipv6)[0]
+  ]
 }
 
-resource "cloudflare_record" "sys_domain_casey_v6" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "casey.sys"
-  value   = split("/", linode_instance.casey.ipv6)[0]
-  type    = "AAAA"
-  ttl     = 1
+resource "gandi_livedns_record" "sys_domain_walker" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "walker.sys"
+  type = "A"
+  ttl  = 3600
+  values = [
+    hcloud_server.walker.ipv4_address
+  ]
 }
 
-resource "cloudflare_record" "sys_domain_walker_v6" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "walker.sys"
-  value   = hcloud_server.walker.ipv6_address
-  type    = "AAAA"
-  ttl     = 1
+resource "gandi_livedns_record" "sys_domain_walker_v6" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "walker.sys"
+  type = "AAAA"
+  ttl  = 3600
+  values = [
+    hcloud_server.walker.ipv6_address
+  ]
 }
 
-resource "cloudflare_record" "sys_domain_pve" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "pve.sys"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
-  ttl     = 1
+resource "gandi_livedns_record" "sys_domain_pve" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "pve.sys"
+  type = "A"
+  ttl  = 3600
+  values = [
+    linode_instance.casey.ip_address
+  ]
 }
 
-resource "cloudflare_record" "sys_domain_pve_private" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "pve-private.sys"
-  value   = local.private_ipv6_marker
-  type    = "AAAA"
-  ttl     = 1
+resource "gandi_livedns_record" "sys_domain_pve_private" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "pve-private.sys"
+  type = "AAAA"
+  ttl  = 3600
+  values = [
+    local.private_ipv6_marker
+  ]
 }
diff --git a/terraform/theorangeone.net.tf b/terraform/theorangeone.net.tf
index 4defa9a..e7ef478 100644
--- a/terraform/theorangeone.net.tf
+++ b/terraform/theorangeone.net.tf
@@ -2,240 +2,261 @@ resource "gandi_livedns_domain" "theorangeonenet" {
   name = "theorangeone.net"
 }
 
-###
-
-resource "cloudflare_zone" "theorangeonenet" {
-  zone = "theorangeone.net"
+resource "gandi_livedns_record" "theorangeonenet_git" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "git"
+  type = "CNAME"
+  ttl  = 3600
+  values = [
+    gandi_livedns_record.sys_domain_pve.href
+  ]
 }
 
-resource "cloudflare_record" "theorangeonenet_git" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "git"
-  value   = cloudflare_record.sys_domain_pve.hostname
-  type    = "CNAME"
-  ttl     = 1
+resource "gandi_livedns_record" "theorangeonenet_whoami" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "whoami"
+  type = "CNAME"
+  ttl  = 3600
+  values = [
+    gandi_livedns_record.sys_domain_pve.href
+  ]
 }
 
-resource "cloudflare_record" "theorangeonenet_whoami" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "whoami"
-  value   = cloudflare_record.sys_domain_pve.hostname
-  type    = "CNAME"
-  ttl     = 1
+resource "gandi_livedns_record" "theorangeonenet_whoami_cdn" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "whoami-cdn"
+  type = "CNAME"
+  ttl  = 3600
+  values = [
+    gandi_livedns_record.sys_domain_pve.href
+  ]
 }
 
-resource "cloudflare_record" "theorangeonenet_whoami_cdn" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "whoami-cdn"
-  value   = cloudflare_record.sys_domain_casey.hostname
-  type    = "CNAME"
-  ttl     = 1
+resource "gandi_livedns_record" "theorangeonenet_whoami_private" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "whoami-private"
+  type = "CNAME"
+  ttl  = 3600
+  values = [
+    gandi_livedns_record.sys_domain_pve.href
+  ]
 }
 
-resource "cloudflare_record" "theorangeonenet_whoami_private" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "whoami-private"
-  value   = cloudflare_record.sys_domain_pve_private.hostname
-  type    = "CNAME"
-  ttl     = 1
+resource "gandi_livedns_record" "theorangeonenet_mx" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "@"
+  type = "MX"
+  ttl  = 3600
+  values = [
+    "10 in1-smtp.messagingengine.com",
+    "20 in2-smtp.messagingengine.com",
+  ]
 }
 
-resource "cloudflare_record" "theorangeonenet_mx1" {
-  zone_id  = cloudflare_zone.theorangeonenet.id
-  name     = "@"
-  value    = "in1-smtp.messagingengine.com"
-  type     = "MX"
-  priority = 10
-  ttl      = 1
+resource "gandi_livedns_record" "theorangeonenet_spf" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "@"
+  type = "TXT"
+  ttl  = 3600
+  values = [
+    "\"v=spf1 include:spf.messagingengine.com -all\""
+  ]
 }
 
-resource "cloudflare_record" "theorangeonenet_mx2" {
-  zone_id  = cloudflare_zone.theorangeonenet.id
-  name     = "@"
-  value    = "in2-smtp.messagingengine.com"
-  type     = "MX"
-  priority = 20
-  ttl      = 1
+resource "gandi_livedns_record" "theorangeonenet_dkim_fm1" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "fm1._domainkey"
+  type = "CNAME"
+  ttl  = 3600
+  values = [
+    "fm1.theorangeone.net.dkim.fmhosted.com"
+  ]
 }
 
-resource "cloudflare_record" "theorangeonenet_spf" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "@"
-  value   = "v=spf1 include:spf.messagingengine.com -all"
-  type    = "TXT"
-  ttl     = 1
+resource "gandi_livedns_record" "theorangeonenet_dkim_fm2" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "fm2._domainkey"
+  type = "CNAME"
+  ttl  = 3600
+  values = [
+    "fm2.theorangeone.net.dkim.fmhosted.com"
+  ]
 }
 
-resource "cloudflare_record" "theorangeonenet_dkim_fm1" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "fm1._domainkey"
-  value   = "fm1.theorangeone.net.dkim.fmhosted.com"
-  type    = "CNAME"
-  ttl     = 1
+resource "gandi_livedns_record" "theorangeonenet_dkim_fm3" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "fm3._domainkey"
+  type = "CNAME"
+  ttl  = 3600
+  values = [
+    "fm3.theorangeone.net.dkim.fmhosted.com"
+  ]
 }
 
-resource "cloudflare_record" "theorangeonenet_dkim_fm2" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "fm2._domainkey"
-  value   = "fm2.theorangeone.net.dkim.fmhosted.com"
-  type    = "CNAME"
-  ttl     = 1
+resource "gandi_livedns_record" "theorangeonenet_dmarc" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "_dmarc"
+  type = "TXT"
+  ttl  = 3600
+  values = [
+    "\"v=DMARC1; p=quarantine; ruf=mailto:dmarc-report@jakehoward.tech;\""
+  ]
 }
 
-resource "cloudflare_record" "theorangeonenet_dkim_fm3" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "fm3._domainkey"
-  value   = "fm3.theorangeone.net.dkim.fmhosted.com"
-  type    = "CNAME"
-  ttl     = 1
-}
-
-resource "cloudflare_record" "theorangeonenet_dmarc" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "_dmarc"
-  value   = "v=DMARC1; p=quarantine; ruf=mailto:dmarc-report@jakehoward.tech;"
-  type    = "TXT"
-  ttl     = 1
-}
-
-resource "cloudflare_record" "theorangeonenet_dmarc_report" {
+resource "gandi_livedns_record" "theorangeonenet_dmarc_report" {
   for_each = toset([
-    cloudflare_zone.theorangeonenet.zone,
-    cloudflare_zone.jakehowardtech.zone,
-    cloudflare_record.theorangeonenet_mailgun_spf.hostname,
+    gandi_livedns_domain.theorangeonenet.name,
+    gandi_livedns_domain.jakehowardtech.name,
+    gandi_livedns_record.theorangeonenet_mailgun_spf.href,
     cloudflare_record.jakehowardtech_mailgun_spf.hostname,
   ])
 
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "${each.value}._report._dmarc"
-  value   = "v=DMARC1"
-  type    = "TXT"
-  ttl     = 1
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "${each.value}._report._dmarc"
+  type = "TXT"
+  ttl  = 3600
+  values = [
+    "v=DMARC1"
+  ]
 }
 
-# Cloudflare supports CNAME flattening - so this is ok
-resource "cloudflare_record" "theorangeonenet_apex" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "@"
-  value   = cloudflare_record.sys_domain_walker.hostname
-  type    = "CNAME"
-  ttl     = 1
+resource "gandi_livedns_record" "theorangeonenet_apex" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "@"
+  type = "ALIAS"
+  ttl  = 3600
+  values = [
+    gandi_livedns_record.sys_domain_walker.href
+  ]
 }
 
-resource "cloudflare_record" "theorangeonenet_srv_matrix" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "_matrix._tcp"
-  type    = "SRV"
-  ttl     = 1
-
-  data = {
-    service  = "_matrix"
-    proto    = "_tcp"
-    name     = cloudflare_zone.theorangeonenet.zone
-    priority = 10
-    weight   = 0
-    port     = 8448
-    target   = cloudflare_record.theorangeonenet_matrix.hostname
-  }
+resource "gandi_livedns_record" "theorangeonenet_srv_matrix" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "_matrix._tcp"
+  type = "SRV"
+  ttl  = 3600
+  values = [
+    "10 0 8448 ${gandi_livedns_record.theorangeonenet_matrix.href}."
+  ]
 }
 
-resource "cloudflare_record" "theorangeonenet_matrix" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "matrix"
-  value   = cloudflare_record.sys_domain_pve.hostname
-  type    = "CNAME"
-  ttl     = 1
+resource "gandi_livedns_record" "theorangeonenet_matrix" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "matrix"
+  type = "CNAME"
+  ttl  = 3600
+  values = [
+    gandi_livedns_record.sys_domain_pve.href
+  ]
 }
 
-resource "cloudflare_record" "theorangeonenet_plausible" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "plausible"
-  value   = cloudflare_record.sys_domain_walker.hostname
-  type    = "CNAME"
-  ttl     = 1
+resource "gandi_livedns_record" "theorangeonenet_plausible" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "plausible"
+  type = "CNAME"
+  ttl  = 3600
+  values = [
+    gandi_livedns_record.sys_domain_walker.href
+  ]
 }
 
-resource "cloudflare_record" "theorangeonenet_plausible_bare" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "elbisualp"
-  value   = cloudflare_record.sys_domain_walker.hostname
-  type    = "CNAME"
-  ttl     = 1
+resource "gandi_livedns_record" "theorangeonenet_plausible_bare" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "elbisualp"
+  type = "CNAME"
+  ttl  = 3600
+  values = [
+    gandi_livedns_record.sys_domain_walker.href
+  ]
 }
 
-resource "cloudflare_record" "theorangeonenet_notes" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "notes"
-  value   = "realorangeone.github.io"
-  type    = "CNAME"
-  ttl     = 1
+resource "gandi_livedns_record" "theorangeonenet_notes" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "notes"
+  type = "CNAME"
+  ttl  = 3600
+  values = [
+    "realorangeone.github.io"
+  ]
 }
 
-resource "cloudflare_record" "theorangeonenet_privatebin" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "bin"
-  value   = cloudflare_record.sys_domain_pve.hostname
-  type    = "CNAME"
-  ttl     = 1
+resource "gandi_livedns_record" "theorangeonenet_bin" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "bin"
+  type = "CNAME"
+  ttl  = 3600
+  values = [
+    gandi_livedns_record.sys_domain_pve.href
+  ]
 }
 
-resource "cloudflare_record" "theorangeonenet_google_site_verification" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "@"
-  value   = "google-site-verification=IXY4iSBN_vOcM3cp_f-BgVvEI_shz1GzXuY_8dqY61o"
-  type    = "TXT"
-  ttl     = 1
+resource "gandi_livedns_record" "theorangeonenet_google_site_verification" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "@"
+  type = "TXT"
+  ttl  = 3600
+  values = [
+    "google-site-verification=IXY4iSBN_vOcM3cp_f-BgVvEI_shz1GzXuY_8dqY61o"
+  ]
 }
 
-resource "cloudflare_record" "theorangeonenet_mailgun_spf" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "mg"
-  value   = "v=spf1 include:mailgun.org -all"
-  type    = "TXT"
-  ttl     = 1
+resource "gandi_livedns_record" "theorangeonenet_mailgun_spf" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "mg"
+  type = "TXT"
+  ttl  = 3600
+  values = [
+    "\"v=spf1 include:mailgun.org -all\""
+  ]
 }
 
-resource "cloudflare_record" "theorangeonenet_mailgun_dkim" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "mta._domainkey.mg"
-  value   = "k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1Z/MHEzpbWm5EgMkyWb+Xkz44Xrzr4SA5i2u8M2H5yZ1PSb4DpGk3IAX+I05UWax02+WBW3CBb5wU9rH9flgxezBoCf/hiMS1Wjb9hKGIBa2jMCzpF+wa5fyqLkLoAJZF4bc/BJKyi/ET2c7+DAA/2KlWv/nv4MEjcUR4hNGLPEC9+6PhUp8z2PnUQLzPRWHpKc1oLrnROWaX3XxdDekCzwyOw7ygzZdThVevE+0CqXVOt5SUSUCnd2tjVbvblGi6DBiQY5Tl6+xLqkQHCRqks9187+EN4FdJXkjQodkFzzyiBH5cXVGiZLOhal4koEvxGirr596qM97bIXiJWArdQIDAQAB"
-  type    = "TXT"
-  ttl     = 1
+resource "gandi_livedns_record" "theorangeonenet_mailgun_dkim" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "mta._domainkey.mg"
+  type = "TXT"
+  ttl  = 3600
+  values = [
+    "\"k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1Z/MHEzpbWm5EgMkyWb+Xkz44Xrzr4SA5i2u8M2H5yZ1PSb4DpGk3IAX+I05UWax02+WBW3CBb5wU9rH9flgxezBoCf/hiMS1Wjb9hKGIBa2jMCzpF+wa5fyqLkLoAJZF4bc/BJKyi/ET2c7+DAA/2KlWv/nv4MEjcUR4hNGLPEC9+6PhUp8z2PnUQLzPRWHpKc1oLrnROWaX3XxdDekCzwyOw7ygzZdThVevE+0CqXVOt5SUSUCnd2tjVbvblGi6DBiQY5Tl6+xLqkQHCRqks9187+EN4FdJXkjQodkFzzyiBH5cXVGiZLOhal4koEvxGirr596qM97bIXiJWArdQIDAQAB\""
+  ]
 }
 
-resource "cloudflare_record" "theorangeonenet_mailgun_dmarc" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "_dmarc.mg"
-  value   = "v=DMARC1; p=quarantine; ruf=mailto:dmarc-report@jakehoward.tech;"
-  type    = "TXT"
-  ttl     = 1
+resource "gandi_livedns_record" "theorangeonenet_mailgun_dmarc" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "_dmarc.mg"
+  type = "TXT"
+  ttl  = 3600
+  values = [
+    "\"v=DMARC1; p=quarantine; ruf=mailto:dmarc-report@jakehoward.tech;\""
+  ]
 }
 
-resource "cloudflare_record" "theorangeonenet_mastodon" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "mastodon"
-  value   = cloudflare_record.sys_domain_pve.hostname
-  type    = "CNAME"
-  ttl     = 1
+resource "gandi_livedns_record" "theorangeonenet_mastodon" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "mastodon"
+  type = "CNAME"
+  ttl  = 3600
+  values = [
+    gandi_livedns_record.sys_domain_pve.href
+  ]
 }
 
-resource "cloudflare_record" "theorangeonenet_comentario" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "comentario"
-  value   = cloudflare_record.sys_domain_walker.value
-  type    = "A"
-  ttl     = 1
+resource "gandi_livedns_record" "theorangeonenet_comentario" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "comentario"
+  type = "CNAME"
+  ttl  = 3600
+  values = [
+    gandi_livedns_record.sys_domain_walker.href
+  ]
 }
 
-resource "cloudflare_record" "theorangeonenet_caa" {
-  zone_id = cloudflare_zone.theorangeonenet.id
-  name    = "@"
-  type    = "CAA"
-  ttl     = 1
-
-  data = {
-    tag   = "issue"
-    flags = 0
-    value = "letsencrypt.org"
-  }
+resource "gandi_livedns_record" "theorangeonenet_caa" {
+  zone = gandi_livedns_domain.theorangeonenet.id
+  name = "@"
+  type = "CAA"
+  ttl  = 3600
+  values = [
+    "0 issue \"letsencrypt.org\"",
+    "0 wildissue \"letsencrypt.org\"",
+  ]
 }
diff --git a/terraform/walker_vps.tf b/terraform/walker_vps.tf
index 3bf5fd0..14fe07a 100644
--- a/terraform/walker_vps.tf
+++ b/terraform/walker_vps.tf
@@ -16,11 +16,11 @@ resource "hcloud_server" "walker" {
 resource "hcloud_rdns" "walker_reverse_ipv4" {
   server_id  = hcloud_server.walker.id
   ip_address = hcloud_server.walker.ipv4_address
-  dns_ptr    = cloudflare_record.sys_domain_walker.hostname
+  dns_ptr    = gandi_livedns_record.sys_domain_walker.href
 }
 
 resource "hcloud_rdns" "walker_reverse_ipv6" {
   server_id  = hcloud_server.walker.id
   ip_address = hcloud_server.walker.ipv6_address
-  dns_ptr    = cloudflare_record.sys_domain_walker.hostname
+  dns_ptr    = gandi_livedns_record.sys_domain_walker.href
 }