---
id: w5/m10/t004
title: Backend — per-domain DNS record target + verify verb across REST/GraphQL/MCP
worker: worker5
status: done
estimate: 60m
depends_on: [w5/m10/t003]
---

## Objective

Extend the custom-domains core so every domain carries the DNS record the tenant must create — record type derived from `domainType` (subdomain → CNAME to the app's platform host; apex → the captured Render guidance), host, and target — and add the Render-compatible verify verb (`POST /v1/services/{id}/custom-domains/{name}/verify` re-checking cert/DNS state now). One change in the core, surfaced identically by all three adapters.

## Context

- `lego/backend/internal/apps/domains.go` — `DomainView` (has `domainType`/`verificationStatus`/`serverStatus`; lacks any DNS-target field) and the core list/add/get/delete verbs the adapters share.
- The CNAME target is the platform hostname the app already exposes (`<name>.<BEX_BASE_DOMAIN>` / the app URL the `server` query returns) — no new operator work needed.
- Adapters: `apps/rest.go` (custom-domains routes), `apps/graphql.go` (`customDomains` field resolvers), `apps/mcp.go` (4 domain tools). Render's REST has `…/custom-domains/{idOrName}/verify` (confirmed in the 2026-07-09 API re-audit).
- Follow `docs/ADR006-bex-api.md`'s one-core/thin-adapters rule; field spelling per the t003 capture.

## Steps

1. Add DNS-record fields to the domain core view (type/host/target per `domainType`), derived from the app's platform host.
2. Add the verify verb to the core (re-evaluate TLS-secret/cert state now) and expose it: REST `POST …/verify`, GraphQL mutation, MCP tool.
3. Regenerate/extend adapter wiring; update `docs/ADR006-bex-api.md`'s domain section.

## Files

- `lego/backend/internal/apps/{domains.go,rest.go,graphql.go,mcp.go}`
- `docs/ADR006-bex-api.md`

## Acceptance criteria

- [ ] REST, GraphQL, and MCP all return the same DNS-record fields for a subdomain (CNAME → platform host) and an apex (captured guidance).
- [ ] The verify verb exists on all three surfaces and re-checks status Render-compatibly (shape per t003 capture).
- [ ] `cd lego/backend && go build ./... && go test ./...` green.

## Out of scope

- Dashboard rendering (t005); operator/cert-manager changes (mechanism already issues certs).
