Observed (mx99, test.kilimanjaro.io, 2026-10-08)

Working: - ZDS created the domain authority account did:plc:6ynxrsfjhhm62o72cgptdvmo and published it at plc.directory: alsoKnownAs at://postmaster.at.test.kilimanjaro.io, PDS endpoint https://test-kilimanjaro-io.pds1.eu.sovrn.at. The PDS answers describeServer publicly over IPv4 and IPv6.

Not working: 1. Crawl request lost. At activation ZDS called requestCrawl on https://bsky.network and https://vsky.network; both failed (CrawlerRejected; bsky.network: HostNotFound, ‘server is not a PDS: … describeServer: context deadline exceeded’), most likely because Caddy was still issuing the PDS host’s on-demand certificate. Nothing retries. A manual requestCrawl at 04:59 succeeded: getHostStatus now says status active, but accountCount 0, seq -1. The account was created before the relay subscribed, so the relay never saw its #identity/#account events and the AppView has no profile. 2. Handle doesn’t resolve. postmaster.at.test.kilimanjaro.io has no DNS at all (no A/AAAA/CNAME, no _atproto TXT), so the handle can’t be verified. The design (docs/runbooks/pds-domain-migration.md) has the customer publish *.at.<domain> CNAME <slug>.pds1.<region>.sovrn.at, but sovrnd’s expected-records list (internal/dnsprober expectedRecords: MX, SPF, DKIM/relay CNAMEs) doesn’t include it, so the domain passed its DNS checks without it and the user was never asked for it.

Wanted

• Retry requestCrawl after activation until each crawler accepts (backoff; give up loudly after a while), or schedule it after the health gate and certificate issuance; a periodic re-request for hosts whose getHostStatus shows them unknown.
• After the crawl is accepted, make sure each existing account emits an event the relay sees (e.g. an identity refresh / #identity + #account), so accounts created before the subscription are indexed. Check what ZDS offers for this.
• Add *.at.<domain> (CNAME to the domain’s PDS host) to the expected records and the DNS table shown to the user, and gate readiness on it (or report it as a warning, if handles are optional for mail-only domains).
• Health: report per-domain crawl/handle status (sovrnd /healthz or the domain page), so a domain whose PDS identity is invisible doesn’t look finished.

For test.kilimanjaro.io now

Publish *.at.test.kilimanjaro.io CNAME test-kilimanjaro-io.pds1.eu.sovrn.at, then trigger an identity event for the postmaster account so the relay indexes it.

Found during fleet Phase 10 prep (rehearsal baseline).