An infrastructure domain. It carries the pair of authoritative nameservers that the rest of the estate delegates to, and a handful of small services that wanted a short name.
Authoritative DNS for 51 zones. Also a recursor, but only for queries arriving over the fd53 overlay — it will not resolve for the open internet. Runs an Iroh relay on the same host.
The second of the pair, in a different region and a separate failure domain. Same three roles: authoritative DNS, mesh-only recursor, Iroh relay.
The itys.net BBS, a coldbbs system. No telnet, no terminal emulator: the board speaks HTTP and every screen is a URL, so it reads the same in a browser as it would have on a modem.
Universal Time Clock — a seven-segment readout of UTC, sized to be legible across a room. Also answers at timecard.rns.sh, which is the same application under a second name.
The mail host. Nothing listens on 443 — this name exists for MX and client configuration, not for browsing.
An OpenBSD control node in Amsterdam, and the only member of the fd53 overlay that is not Linux. It originates AS 64622 and the fd53:0301:4001::/48 prefix, and peers with both hubs and both nameservers.
rns.sh is itself delegated to DigitalOcean's nameservers, not
to the pair above. That is deliberate rather than an oversight: a nameserver
cannot supply the address record that tells the world where to find it, so
ns-01 and ns-02 have to be resolvable by something
other than themselves.
Every other zone in the estate delegates here. This one zone is the bootstrap, and it lives elsewhere on purpose.