{lib, ...}: let
  /*
  Computes a reasonable value for the DNS serial number from the date of last change
  and the iteration of that day.

  # Type

  mkSerial :: Number -> Number -> Number -> Number -> Number

  # Arguments

  year
  : The year of the last change in the format YYYY.

  month
  : The month of the last change in the format MM.

  day
  : The day of the last change in the format DD.

  iteration
  : The number of change on that day. The format should be CC (assuming there are less
    than 100 changes happening on a day) .

  # Examples

  mkSerial 2025 04 01 01
  => 2025040101
  */
  mkSerial = year: month: day: iteration: let
    n2 = lib.strings.fixedWidthNumber 2;
    n4 = lib.strings.fixedWidthNumber 4;
  in
    lib.strings.toIntBase10 "${n4 year}${n2 month}${n2 day}${n2 iteration}";
in {
  SOA = {
    nameServer = "name-server1.jaki.li.";
    adminEmail = "dns-admin@foss-syndicate.org";
    # NOTE(@bpeetz): ALWAYS change the serial number, when you change something in the
    # zone file! <2025-04-01>
    serial = mkSerial 2026 08 14 02;
  };
  useOrigin = false;

  # NOTE: matrix/mastodon need to have the point from `vhack.eu` to their IP <2025-03-10>
  A = [
    "92.60.38.179"
  ];
  AAAA = [
    "2a03:4000:33:25b::4f4e"
  ];

  NS = [
    "name-server1.jaki.li."
    "name-server2.jaki.li."
  ];

  CAA = [
    {
      issuerCritical = false;
      tag = "issue";
      value = "letsencrypt.org";
    }
  ];

  # Mail section {{{
  MX = [
    # {
    #   preference = 10;
    #   exchange = "mail.vhack.eu.";
    # }
    {
      preference = 10;
      exchange = "mail.foss-syndicate.org.";
    }
  ];

  # https://www.rfc-editor.org/rfc/rfc7208.html
  TXT = [
    (builtins.concatStringsSep " " [
      "v=spf1" # The version.
      "+mx" # Allow mail from this domain MX record.
      "-all" # Reject all other emails if the previous mechanism did not match.
    ])
  ];

  # https://www.rfc-editor.org/rfc/rfc6376.html#section-3.6.1
  # https://www.rfc-editor.org/rfc/rfc6376.html#section-7.5
  DKIM = [
    {
      selector = "mail";
      k = "ed25519";
      p = "U0eOxgLD3yK7PKzQRSZdJ3EH/UwVxPeYmfm42gYXsDg=";
      s = ["email"];
      t = ["s"];
    }
  ];

  # https://www.rfc-editor.org/rfc/rfc7489.html#section-6.3
  DMARC = [
    {
      adkim = "strict";
      aspf = "strict";
      fo = [
        "0"
        "1"
        "d"
        "s"
      ];
      p = "reject";
      rua = "admin@foss-syndicate.org";
      ruf = ["admin@foss-syndicate.org"];
    }
  ];

  # https://www.rfc-editor.org/rfc/rfc2782.txt
  SRV = [
    {
      service = "imaps";
      proto = "tcp";
      priority = 0;
      weight = 1;
      port = 993;
      target = "mail.foss-syndicate.org.";
    }
    {
      service = "pop3s";
      proto = "tcp";
      priority = 0;
      weight = 1;
      port = 995;
      target = "mail.foss-snydicate.org.";
    }
    {
      service = "smtps";
      proto = "tcp";
      priority = 0;
      weight = 1;
      port = 465;
      target = "mail.foss-syndicate.org.";
    }
  ];
  # }}}

  subdomains = {
    name-server1.CNAME = ["server2.vhack.eu."];
    name-server2.CNAME = ["server3.vhack.eu."];
  };
}