diff --git a/api/dns.test.ts b/api/dns.test.ts
new file mode 100644
index 0000000..91f1bd9
--- /dev/null
+++ b/api/dns.test.ts
@@ -0,0 +1,57 @@
+import { describe, expect, test } from 'bun:test';
+import { providerFromNameservers, normaliseDomain, looksLikeDomain } from './dns';
+
+/**
+ * The pure half of the DNS check.
+ *
+ * `checkDomain` itself talks to a resolver and to a public-IP service, so a test of it would be a test of
+ * this machine's network. What can actually be WRONG without anybody noticing is in here: which provider a
+ * set of nameservers means, and what counts as a domain.
+ */
+
+describe('providerFromNameservers', () => {
+  test('the common ones', () => {
+    expect(providerFromNameservers(['ana.ns.cloudflare.com', 'bob.ns.cloudflare.com'])).toBe('cloudflare');
+    expect(providerFromNameservers(['ns01.domaincontrol.com'])).toBe('godaddy');
+    expect(providerFromNameservers(['ns-1234.awsdns.org'])).toBe('route53');
+    expect(providerFromNameservers(['ns1.digitalocean.com'])).toBe('digitalocean');
+  });
+
+  test('a trailing dot and capitals, which is how resolvers actually answer', () => {
+    expect(providerFromNameservers(['ANA.NS.CLOUDFLARE.COM.'])).toBe('cloudflare');
+  });
+
+  // `ns-cloud-a1.googledomains.com` ends with `google.com`? No — but `ns1.google.com` does, and a shorter
+  // entry must not win over a longer one that also matches. Longest suffix, always.
+  test('the longest matching suffix wins', () => {
+    expect(providerFromNameservers(['ns-cloud-a1.googledomains.com'])).toBe('google');
+  });
+
+  test('an unrecognised nameserver is null rather than a guess', () => {
+    expect(providerFromNameservers(['ns1.some-small-host.example'])).toBeNull();
+    expect(providerFromNameservers([])).toBeNull();
+  });
+});
+
+describe('normaliseDomain', () => {
+  test('strips what people actually paste', () => {
+    expect(normaliseDomain('  https://Officer.dev/some/path  ')).toBe('officer.dev');
+    expect(normaliseDomain('officer.dev.')).toBe('officer.dev');
+    expect(normaliseDomain('HTTP://OFFICER.DEV')).toBe('officer.dev');
+  });
+});
+
+describe('looksLikeDomain', () => {
+  test('accepts real ones, including a subdomain and a long TLD', () => {
+    expect(looksLikeDomain('officer.dev')).toBe(true);
+    expect(looksLikeDomain('sub.officer.dev')).toBe(true);
+    expect(looksLikeDomain('a-b.example.museum')).toBe(true);
+  });
+
+  test('rejects the obvious nonsense, and leaves the rest to DNS', () => {
+    expect(looksLikeDomain('officer')).toBe(false);
+    expect(looksLikeDomain('-officer.dev')).toBe(false);
+    expect(looksLikeDomain('officer .dev')).toBe(false);
+    expect(looksLikeDomain('')).toBe(false);
+  });
+});
diff --git a/api/dns.ts b/api/dns.ts
new file mode 100644
index 0000000..a8d754c
--- /dev/null
+++ b/api/dns.ts
@@ -0,0 +1,219 @@
+import { promises as dns } from 'node:dns';
+
+/**
+ * What DNS can tell us about a domain, and what it cannot.
+ *
+ * Two questions, asked by the check button before a domain is saved and again whenever it is refreshed:
+ * **who answers for this name**, and **where does it point**. Both are cheap, both are observations rather
+ * than settings, and neither is stored as authority — see `proxyManagerDomains`.
+ */
+
+/** Never let a slow or missing resolver hold a request open. */
+const TIMEOUT_MS = 5_000;
+
+const withTimeout = async <T>(work: Promise<T>, fallback: T): Promise<T> => {
+  try {
+    return await Promise.race([
+      work,
+      new Promise<T>((resolve) => setTimeout(() => resolve(fallback), TIMEOUT_MS)),
+    ]);
+  } catch {
+    // NXDOMAIN, SERVFAIL, no records of that type — all ordinary answers to "does this exist", and none
+    // of them is an error worth propagating. The caller distinguishes them by what came back empty.
+    return fallback;
+  }
+};
+
+/**
+ * Nameserver suffix → the provider that runs it.
+ *
+ * **This identifies the DNS HOST, which is the one that matters here**: it is whose API can place an
+ * `_acme-challenge` record. It is frequently NOT the registrar — a domain bought at GoDaddy and delegated
+ * to Cloudflare answers `cloudflare` — and the UI says "DNS provider" for that reason.
+ *
+ * Longest suffix wins, so `ns-cloud-a1.googledomains.com` cannot be caught by a shorter entry first.
+ * An unknown nameserver is reported as `null` with the raw records kept: "we do not recognise this" is a
+ * better answer than a wrong guess, and the owner can still read the nameservers themselves.
+ */
+const NS_PROVIDERS: { suffix: string; provider: string }[] = [
+  { suffix: 'cloudflare.com', provider: 'cloudflare' },
+  { suffix: 'domaincontrol.com', provider: 'godaddy' },
+  { suffix: 'godaddy.com', provider: 'godaddy' },
+  { suffix: 'awsdns-00.org', provider: 'route53' },
+  { suffix: 'awsdns.com', provider: 'route53' },
+  { suffix: 'awsdns.net', provider: 'route53' },
+  { suffix: 'awsdns.org', provider: 'route53' },
+  { suffix: 'awsdns.co.uk', provider: 'route53' },
+  { suffix: 'digitalocean.com', provider: 'digitalocean' },
+  { suffix: 'registrar-servers.com', provider: 'namecheap' },
+  { suffix: 'googledomains.com', provider: 'google' },
+  { suffix: 'google.com', provider: 'google' },
+  { suffix: 'azure-dns.com', provider: 'azure' },
+  { suffix: 'azure-dns.net', provider: 'azure' },
+  { suffix: 'azure-dns.org', provider: 'azure' },
+  { suffix: 'linode.com', provider: 'linode' },
+  { suffix: 'vultr.com', provider: 'vultr' },
+  { suffix: 'hetzner.com', provider: 'hetzner' },
+  { suffix: 'hetzner.de', provider: 'hetzner' },
+  { suffix: 'ovh.net', provider: 'ovh' },
+  { suffix: 'gandi.net', provider: 'gandi' },
+  { suffix: 'porkbun.com', provider: 'porkbun' },
+  { suffix: 'dnsimple.com', provider: 'dnsimple' },
+  { suffix: 'desec.io', provider: 'desec' },
+  { suffix: 'njal.la', provider: 'njalla' },
+  { suffix: 'name.com', provider: 'namedotcom' },
+  { suffix: 'dnsmadeeasy.com', provider: 'dnsmadeeasy' },
+  { suffix: 'nsone.net', provider: 'ns1' },
+  { suffix: 'hover.com', provider: 'hover' },
+  { suffix: 'dreamhost.com', provider: 'dreamhost' },
+  { suffix: 'bunny.net', provider: 'bunny' },
+];
+
+/** Providers that commonly sit IN FRONT of an origin, so an address that is not ours may still be right. */
+const PROXYING_PROVIDERS = new Set(['cloudflare', 'bunny']);
+
+export const providerFromNameservers = (nameservers: string[]): string | null => {
+  const found = nameservers
+    .map((ns) => ns.toLowerCase().replace(/\.$/, ''))
+    .flatMap((ns) => NS_PROVIDERS.filter((entry) => ns.endsWith(entry.suffix)))
+    .sort((a, b) => b.suffix.length - a.suffix.length);
+  return found[0]?.provider ?? null;
+};
+
+/**
+ * Where a domain points, as a verdict rather than an address.
+ *
+ * `here`       at least one address is this machine's public IP.
+ * `private`    it resolves inside a VPN range — correct for a tailnet-only name, and invisible to any
+ *              check that only compares against a public address.
+ * `elsewhere`  it resolves, and not to us. Which may be wrong, or may be a proxy — see `maybeProxied`.
+ * `nowhere`    it does not resolve at all. A new domain, or a typo.
+ * `unknown`    we could not establish our own public address, so "is that us" has no answer. Saying so is
+ *              the point: reporting `elsewhere` here would be a confident wrong answer.
+ */
+export type PointsTo = 'here' | 'private' | 'elsewhere' | 'nowhere' | 'unknown';
+
+/** RFC1918, plus the CGNAT block Tailscale uses (100.64.0.0/10). */
+const isPrivateIp = (ip: string): boolean => {
+  const [a = 0, b = 0] = ip.split('.').map(Number);
+  if (a === 10 || a === 127) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  return false;
+};
+
+/**
+ * This machine's public address, cached.
+ *
+ * Asked of an outside service because there is no reliable local answer: the host may be behind NAT, and
+ * the interface addresses are not what the internet sees. Cached for an hour — a residential address can
+ * change, and re-asking on every check would put a third-party request behind a button.
+ *
+ * Failure is `null` and that is a real state, not an error. It means the "does it point here" question
+ * cannot be answered, which the verdict reports as `unknown` rather than guessing.
+ */
+let publicIpCache: { ip: string | null; at: number } | null = null;
+const PUBLIC_IP_TTL_MS = 60 * 60 * 1000;
+
+export async function publicIp(): Promise<string | null> {
+  if (publicIpCache && Date.now() - publicIpCache.at < PUBLIC_IP_TTL_MS) return publicIpCache.ip;
+
+  let ip: string | null = null;
+  try {
+    const response = await fetch('https://api.ipify.org', { signal: AbortSignal.timeout(TIMEOUT_MS) });
+    if (response.ok) {
+      const text = (await response.text()).trim();
+      if (/^\d{1,3}(\.\d{1,3}){3}$/.test(text)) ip = text;
+    }
+  } catch {
+    // Offline, blocked, or the service is down. All the same answer here.
+  }
+
+  publicIpCache = { ip, at: Date.now() };
+  return ip;
+}
+
+export type DomainCheck = {
+  domain: string;
+  nameservers: string[];
+  dnsProvider: string | null;
+  resolvedIps: string[];
+  pointsTo: PointsTo;
+  /**
+   * `elsewhere`, but the DNS provider is one that proxies — so this is plausibly a working setup with the
+   * provider in front, rather than a misconfiguration. Stated as a maybe because from a DNS lookup alone
+   * it genuinely is one.
+   */
+  maybeProxied: boolean;
+  /** Our own public address at the time of the check, so the verdict can be read rather than trusted. */
+  machineIp: string | null;
+};
+
+/** Lowercased, trailing dot and any scheme or path removed. `https://Foo.Dev/` → `foo.dev`. */
+export const normaliseDomain = (input: string): string =>
+  input
+    .trim()
+    .toLowerCase()
+    .replace(/^[a-z]+:\/\//, '')
+    .replace(/\/.*$/, '')
+    .replace(/\.$/, '');
+
+/** Loose on purpose: this rejects obvious nonsense, and DNS itself is the real test. */
+export const looksLikeDomain = (domain: string): boolean =>
+  /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/.test(domain) && domain.length <= 253;
+
+/**
+ * Nameservers for a name, falling back to its parent.
+ *
+ * **Only an apex has NS records.** `platform.officer.dev` answers nothing, which would report "provider not
+ * recognised" for a name whose DNS is perfectly well known — and people paste subdomains, whatever the
+ * list is nominally for. So walk up a label at a time until something answers.
+ *
+ * Bounded at three steps, which reaches the apex of anything real (`a.b.c.example.co.uk`) without turning
+ * a typo into a queue of lookups.
+ */
+async function nameserversFor(domain: string): Promise<string[]> {
+  let name = domain;
+  for (let step = 0; step < 4; step += 1) {
+    const found = await withTimeout(dns.resolveNs(name), [] as string[]);
+    if (found.length > 0) return found;
+    const dot = name.indexOf('.');
+    // Two labels left means we are at the apex already; there is no parent worth asking.
+    if (dot === -1 || name.split('.').length <= 2) return [];
+    name = name.slice(dot + 1);
+  }
+  return [];
+}
+
+export async function checkDomain(input: string): Promise<DomainCheck> {
+  const domain = normaliseDomain(input);
+
+  // Asked together: they are independent, and a slow NS lookup should not delay the address one.
+  const [nameservers, v4, v6, machineIp] = await Promise.all([
+    nameserversFor(domain),
+    withTimeout(dns.resolve4(domain), [] as string[]),
+    withTimeout(dns.resolve6(domain), [] as string[]),
+    publicIp(),
+  ]);
+
+  const resolvedIps = [...v4, ...v6];
+  const dnsProvider = providerFromNameservers(nameservers);
+
+  const pointsTo: PointsTo = (() => {
+    if (resolvedIps.length === 0) return 'nowhere';
+    if (v4.some(isPrivateIp)) return 'private';
+    if (!machineIp) return 'unknown';
+    return resolvedIps.includes(machineIp) ? 'here' : 'elsewhere';
+  })();
+
+  return {
+    domain,
+    nameservers: nameservers.map((ns) => ns.toLowerCase().replace(/\.$/, '')),
+    dnsProvider,
+    resolvedIps,
+    pointsTo,
+    maybeProxied: pointsTo === 'elsewhere' && !!dnsProvider && PROXYING_PROVIDERS.has(dnsProvider),
+    machineIp,
+  };
+}
diff --git a/api/domains.ts b/api/domains.ts
new file mode 100644
index 0000000..2d7eacf
--- /dev/null
+++ b/api/domains.ts
@@ -0,0 +1,203 @@
+import { db } from 'officerdb/db';
+import { encryptSecret, decryptSecret } from 'officerdb/crypto';
+import { eq } from 'drizzle-orm';
+import {
+  proxyManagerDomains,
+  proxyManagerDnsCredentials,
+  type ProxyManagerDomain,
+} from '../db/schema';
+import { checkDomain, normaliseDomain, looksLikeDomain, type DomainCheck } from './dns';
+
+/**
+ * Domains, and the DNS credentials that go with them.
+ *
+ * The secret rule is the same one `connection.ts` states and for the same reason: it never leaves this
+ * module in plaintext except into the code that uses it. There is no route that returns a DNS key, at any
+ * level, to anybody. A screen that wants to know whether one exists gets a boolean.
+ */
+
+const PURPOSE = 'proxy-manager';
+
+export type DomainView = {
+  id: number;
+  domain: string;
+  dnsProvider: string | null;
+  pointsTo: string | null;
+  resolvedIps: string[];
+  lastCheckedAt: string | null;
+  /** Whether a credential exists for THIS domain's provider. Never the credential. */
+  hasCredential: boolean;
+  /** `narrow` | `broad` | null. What was handed over, not what it is. */
+  credentialScope: string | null;
+};
+
+const view = (row: ProxyManagerDomain, credentials: Map<string, string>): DomainView => ({
+  id: row.id,
+  domain: row.domain,
+  dnsProvider: row.dnsProvider,
+  pointsTo: row.pointsTo,
+  resolvedIps: row.resolvedIps ?? [],
+  lastCheckedAt: row.lastCheckedAt ? row.lastCheckedAt.toISOString() : null,
+  hasCredential: !!row.dnsProvider && credentials.has(row.dnsProvider),
+  credentialScope: (row.dnsProvider && credentials.get(row.dnsProvider)) ?? null,
+});
+
+/** Provider → scope, for every stored credential. The scope is safe to show; the secret is not. */
+async function credentialScopes(): Promise<Map<string, string>> {
+  const rows = await db
+    .select({ provider: proxyManagerDnsCredentials.provider, scope: proxyManagerDnsCredentials.scope })
+    .from(proxyManagerDnsCredentials);
+  return new Map(rows.map((row) => [row.provider, row.scope]));
+}
+
+export async function listDomains(): Promise<DomainView[]> {
+  const [rows, scopes] = await Promise.all([
+    db.select().from(proxyManagerDomains).orderBy(proxyManagerDomains.domain),
+    credentialScopes(),
+  ]);
+  return rows.map((row) => view(row, scopes));
+}
+
+export class DomainError extends Error {
+  constructor(
+    message: string,
+    readonly status: 400 | 404 | 409,
+  ) {
+    super(message);
+  }
+}
+
+/**
+ * Add a domain, checking it on the way in.
+ *
+ * The check is not optional and not deferred: a row with no provider and no verdict is a row somebody has
+ * to remember to refresh, and the whole value of the list is that it says something. A domain that does
+ * not resolve is still added — "nowhere" is a real and common state for a name bought ten minutes ago —
+ * but it is added with that recorded rather than blank.
+ */
+export async function addDomain(input: string): Promise<DomainView> {
+  const domain = normaliseDomain(input);
+  if (!looksLikeDomain(domain)) throw new DomainError(`"${input}" does not look like a domain.`, 400);
+
+  const existing = await db.select().from(proxyManagerDomains).where(eq(proxyManagerDomains.domain, domain));
+  if (existing.length > 0) throw new DomainError(`${domain} is already here.`, 409);
+
+  const checked = await checkDomain(domain);
+  const [row] = await db
+    .insert(proxyManagerDomains)
+    .values({
+      domain,
+      dnsProvider: checked.dnsProvider,
+      pointsTo: checked.pointsTo,
+      resolvedIps: checked.resolvedIps,
+      lastCheckedAt: new Date(),
+    })
+    .returning();
+
+  return view(row!, await credentialScopes());
+}
+
+/** Re-run the lookup for a domain already on the list, and keep what it says. */
+export async function recheckDomain(id: number): Promise<DomainView> {
+  const [row] = await db.select().from(proxyManagerDomains).where(eq(proxyManagerDomains.id, id));
+  if (!row) throw new DomainError('No such domain.', 404);
+
+  const checked = await checkDomain(row.domain);
+  const [updated] = await db
+    .update(proxyManagerDomains)
+    .set({
+      dnsProvider: checked.dnsProvider,
+      pointsTo: checked.pointsTo,
+      resolvedIps: checked.resolvedIps,
+      lastCheckedAt: new Date(),
+      updatedAt: new Date(),
+    })
+    .where(eq(proxyManagerDomains.id, id))
+    .returning();
+
+  return view(updated!, await credentialScopes());
+}
+
+export async function removeDomain(id: number): Promise<void> {
+  await db.delete(proxyManagerDomains).where(eq(proxyManagerDomains.id, id));
+}
+
+/** A check with nothing stored — what the button does before you commit to adding it. */
+export async function dryCheck(input: string): Promise<DomainCheck> {
+  const domain = normaliseDomain(input);
+  if (!looksLikeDomain(domain)) throw new DomainError(`"${input}" does not look like a domain.`, 400);
+  return checkDomain(domain);
+}
+
+// ── Credentials ─────────────────────────────────────────────────────────────────────────────────────
+
+export type CredentialView = { provider: string; scope: string; label: string | null; updatedAt: string };
+
+export async function listCredentials(): Promise<CredentialView[]> {
+  const rows = await db.select().from(proxyManagerDnsCredentials).orderBy(proxyManagerDnsCredentials.provider);
+  return rows.map((row) => ({
+    provider: row.provider,
+    scope: row.scope,
+    label: row.label,
+    updatedAt: row.updatedAt.toISOString(),
+    // No secret. Deliberately not even a length.
+  }));
+}
+
+export type SaveCredentialParams = {
+  provider: string;
+  /** The provider's own fields — one token, or a key and a secret. Shapes come from NPM's dns-providers list. */
+  fields: Record<string, string>;
+  scope: 'narrow' | 'broad';
+  label?: string;
+};
+
+export async function saveCredential(params: SaveCredentialParams): Promise<CredentialView> {
+  const provider = params.provider.trim().toLowerCase();
+  if (!provider) throw new DomainError('A provider is required.', 400);
+
+  const filled = Object.entries(params.fields ?? {}).filter(([, value]) => typeof value === 'string' && value.trim());
+  if (filled.length === 0) throw new DomainError('The credential is empty.', 400);
+
+  const secret = encryptSecret(PURPOSE, JSON.stringify(Object.fromEntries(filled)));
+  const existing = await db
+    .select()
+    .from(proxyManagerDnsCredentials)
+    .where(eq(proxyManagerDnsCredentials.provider, provider));
+
+  if (existing.length > 0) {
+    await db
+      .update(proxyManagerDnsCredentials)
+      .set({ secret, scope: params.scope, label: params.label ?? null, updatedAt: new Date() })
+      .where(eq(proxyManagerDnsCredentials.provider, provider));
+  } else {
+    await db
+      .insert(proxyManagerDnsCredentials)
+      .values({ provider, secret, scope: params.scope, label: params.label ?? null });
+  }
+
+  const [row] = await db
+    .select()
+    .from(proxyManagerDnsCredentials)
+    .where(eq(proxyManagerDnsCredentials.provider, provider));
+  return { provider, scope: row!.scope, label: row!.label, updatedAt: row!.updatedAt.toISOString() };
+}
+
+export async function removeCredential(provider: string): Promise<void> {
+  await db.delete(proxyManagerDnsCredentials).where(eq(proxyManagerDnsCredentials.provider, provider.toLowerCase()));
+}
+
+/**
+ * Decrypted, for the code that places a challenge record. **Never serialise the result of this.**
+ *
+ * Nothing calls it yet — issuing a certificate through DNS-01 is the next piece, and it is the only thing
+ * that should. It exists now so the storage above is provably usable rather than write-only.
+ */
+export async function readCredentialFields(provider: string): Promise<Record<string, string> | null> {
+  const [row] = await db
+    .select()
+    .from(proxyManagerDnsCredentials)
+    .where(eq(proxyManagerDnsCredentials.provider, provider.toLowerCase()));
+  if (!row) return null;
+  return JSON.parse(decryptSecret(PURPOSE, row.secret)) as Record<string, string>;
+}
diff --git a/api/router.ts b/api/router.ts
index 148c436..6de53c9 100644
--- a/api/router.ts
+++ b/api/router.ts
@@ -2,6 +2,17 @@ import type { Context } from 'hono';
 import { createRouter, type HonoVariables } from '@@/create-router';
 import { deleteConnection, readConnection, readCredentials, recordProbe, saveConnection } from './connection';
 import { NpmError, npmRequest, npmProxy, probe, forgetToken } from './npm-client';
+import {
+  addDomain,
+  dryCheck,
+  listCredentials,
+  listDomains,
+  recheckDomain,
+  removeCredential,
+  removeDomain,
+  saveCredential,
+  DomainError,
+} from './domains';
 
 /**
  * Mounted at `/api/proxy-manager`.
@@ -241,6 +252,107 @@ router.post('/hosts/:id/:action', async (ctx) => {
   );
 });
 
+// ── Domains ─────────────────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Officer's own record of which domains this machine is responsible for, and what DNS says about them.
+ *
+ * **Not NPM's.** NPM knows about hosts it serves; it has no idea which domains you own, and cannot — a
+ * name is only knowable if you already have it. So this is a list the owner curates, with a cached
+ * observation attached to each entry.
+ *
+ * ── The credential half is under `/_config` on purpose ──
+ *
+ * A DNS provider API key can rewrite every record for a domain, which is a strictly larger power than the
+ * NPM login already kept there. Putting those routes under the prefix the manifest marks `ownerOnly` means
+ * the rule is declared once and enforced by the platform, with nothing in this file deciding it twice.
+ *
+ * Reading the domain LIST is not owner-only. Which names this machine serves is the same class of fact as
+ * which proxy hosts exist, and `hasCredential` is a boolean rather than a secret.
+ */
+
+// `Context`, imported — NOT derived from `router.get`. That trick resolves hono's first overload and
+// yields `never`, which is the twelve-error bug this same file was fixed for earlier today. Twice is
+// enough to say it out loud.
+const domainFailure = (ctx: Context<{ Variables: HonoVariables }>, error: unknown) => {
+  if (error instanceof DomainError) return ctx.json({ error: error.message }, error.status);
+  return ctx.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+};
+
+router.get('/domains', async (ctx) => ctx.json(await listDomains()));
+
+/**
+ * Look a domain up without storing anything — the check button, before you commit to adding it.
+ *
+ * A GET with the domain in the query rather than a POST, because it changes nothing. That also means a
+ * read-level account can use it, which is right: this asks public DNS a question anybody could ask.
+ */
+router.get('/domains/check', async (ctx) => {
+  const domain = ctx.req.query('domain') ?? '';
+  try {
+    return ctx.json(await dryCheck(domain));
+  } catch (error) {
+    return domainFailure(ctx, error);
+  }
+});
+
+router.post('/domains', async (ctx) => {
+  const body = (await ctx.req.json().catch(() => null)) as { domain?: string } | null;
+  try {
+    return ctx.json(await addDomain(body?.domain ?? ''));
+  } catch (error) {
+    return domainFailure(ctx, error);
+  }
+});
+
+router.post('/domains/:id/recheck', async (ctx) => {
+  const id = Number(ctx.req.param('id'));
+  if (!Number.isInteger(id)) return ctx.json({ error: 'Expected a domain id.' }, 400);
+  try {
+    return ctx.json(await recheckDomain(id));
+  } catch (error) {
+    return domainFailure(ctx, error);
+  }
+});
+
+router.delete('/domains/:id', async (ctx) => {
+  const id = Number(ctx.req.param('id'));
+  if (!Number.isInteger(id)) return ctx.json({ error: 'Expected a domain id.' }, 400);
+  // Removing a domain forgets Officer's note about it. It changes nothing at the registrar, nothing in
+  // NPM, and nothing about whether the site works — worth saying, because "delete domain" reads much
+  // larger than it is.
+  await removeDomain(id);
+  return ctx.json({ ok: true });
+});
+
+// ── DNS credentials — owner only, by the manifest's `/_config` prefix ────────────────────────────────
+
+router.get('/_config/dns-providers', async (ctx) => ctx.json(await listCredentials()));
+
+router.put('/_config/dns-providers/:provider', async (ctx) => {
+  const body = (await ctx.req.json().catch(() => null)) as
+    | { fields?: Record<string, string>; scope?: string; label?: string }
+    | null;
+  const scope = body?.scope === 'broad' ? 'broad' : 'narrow';
+  try {
+    return ctx.json(
+      await saveCredential({
+        provider: ctx.req.param('provider'),
+        fields: body?.fields ?? {},
+        scope,
+        label: body?.label,
+      }),
+    );
+  } catch (error) {
+    return domainFailure(ctx, error);
+  }
+});
+
+router.delete('/_config/dns-providers/:provider', async (ctx) => {
+  await removeCredential(ctx.req.param('provider'));
+  return ctx.json({ ok: true });
+});
+
 // ── The pass-through ────────────────────────────────────────────────────────────────────────────────
 
 /**
diff --git a/db/schema.ts b/db/schema.ts
index 3807db4..78a26b3 100644
--- a/db/schema.ts
+++ b/db/schema.ts
@@ -1,4 +1,4 @@
-import { pgTable, serial, text, timestamp, integer } from 'drizzle-orm/pg-core';
+import { pgTable, serial, text, timestamp, integer, uniqueIndex } from 'drizzle-orm/pg-core';
 
 /**
  * The connection to Nginx Proxy Manager.
@@ -46,3 +46,108 @@ export const proxyManagerConnection = pgTable('proxy_manager_connection', {
 });
 
 export type ProxyManagerConnection = typeof proxyManagerConnection.$inferSelect;
+
+/**
+ * A domain this machine is responsible for.
+ *
+ * ── Why Officer stores this at all, when DNS already knows ──
+ *
+ * Because "which domains are mine" is not a question DNS can answer — you can only ask about a name you
+ * already have. Today that list lives in a document somebody edits by hand, which is correct on the day it
+ * is written. A row here is the owner saying "this one is mine", and everything else on it is a cached
+ * observation that can be refreshed.
+ *
+ * ── Everything except `domain` is a CACHE ──
+ *
+ * `dnsProvider`, `pointsTo` and `resolvedIps` are what a lookup said at `lastCheckedAt`. They are stored so
+ * a list renders without doing nine DNS queries, and they are never treated as authority: the check can be
+ * re-run, and a stale answer is labelled with its age rather than presented as current.
+ */
+export const proxyManagerDomains = pgTable(
+  'proxy_manager_domains',
+  {
+    id: serial('id').primaryKey(),
+
+    /** The apex, lowercased, no trailing dot — `officer.dev`. Subdomains are not rows; they belong to one. */
+    domain: text('domain').notNull(),
+
+    /**
+     * Who answers for it, derived from its NS records — `cloudflare`, `godaddy`, `route53`.
+     *
+     * **This is the DNS HOST, not the registrar**, and they are frequently different: a domain bought at
+     * GoDaddy with nameservers pointed at Cloudflare answers `cloudflare` here. That is the useful one —
+     * it is whose API can place an ACME challenge record — but it is worth the sentence, because somebody
+     * who knows where they bought a domain will otherwise read this as wrong.
+     */
+    dnsProvider: text('dns_provider'),
+
+    /** What the last check made of where it points — see `PointsTo` in `api/dns.ts`. */
+    pointsTo: text('points_to'),
+
+    /** The addresses it resolved to, so a person can see the actual answer rather than our verdict. */
+    resolvedIps: text('resolved_ips').array(),
+
+    lastCheckedAt: timestamp('last_checked_at', { withTimezone: true }),
+
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => [uniqueIndex('uq_proxy_manager_domains_domain').on(table.domain)],
+);
+
+export type ProxyManagerDomain = typeof proxyManagerDomains.$inferSelect;
+
+/**
+ * One DNS provider's API credential.
+ *
+ * ── Keyed on the PROVIDER, not the domain ──
+ *
+ * One Cloudflare token serves every domain whose DNS is on Cloudflare. Storing a copy per domain would
+ * mean rotating it in six places and getting five of them.
+ *
+ * ── `scope` is narrow or broad, and it is NOT read or write ──
+ *
+ * A DNS-01 challenge works by CREATING a `_acme-challenge` TXT record, so issuing a certificate needs
+ * write access. There is no read-only option that can do it, and offering one would produce a setup that
+ * looks configured and fails at the first renewal — sixty days later, silently.
+ *
+ * What actually differs is blast radius. `narrow` is a token the provider scoped to DNS edits on the zones
+ * that need it; `broad` is a full-account key that can do anything. Both issue certificates. Only the
+ * second lets an agent manage records generally, which is a thing the owner may well want — but should
+ * choose knowing which one they handed over.
+ *
+ * Whether `narrow` is even available is the provider's business: Cloudflare scopes tokens per zone,
+ * GoDaddy's key and secret are account-wide with no scoping at all.
+ */
+export const proxyManagerDnsCredentials = pgTable(
+  'proxy_manager_dns_credentials',
+  {
+    id: serial('id').primaryKey(),
+
+    /** Matches `proxyManagerDomains.dnsProvider` — `cloudflare`, `godaddy`. */
+    provider: text('provider').notNull(),
+
+    /**
+     * The credential itself, encrypted with `encryptSecret('proxy-manager', …)`.
+     *
+     * A JSON object rather than a string, because providers want different fields — Cloudflare one token,
+     * GoDaddy a key AND a secret, Route53 three. NPM already describes those field names per provider
+     * (`GET /nginx/certificates/dns-providers`), so the shape is theirs and this only carries it.
+     *
+     * **Never returned across the API boundary**, at any level, to anybody, including the owner.
+     */
+    secret: text('secret').notNull(),
+
+    /** `narrow` | `broad`. See the note above — this is blast radius, not read versus write. */
+    scope: text('scope').notNull().default('narrow'),
+
+    /** What the owner called it, so a rotated key is recognisable. Optional. */
+    label: text('label'),
+
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => [uniqueIndex('uq_proxy_manager_dns_credentials_provider').on(table.provider)],
+);
+
+export type ProxyManagerDnsCredential = typeof proxyManagerDnsCredentials.$inferSelect;
diff --git a/web/CredentialDialog.tsx b/web/CredentialDialog.tsx
new file mode 100644
index 0000000..38a213d
--- /dev/null
+++ b/web/CredentialDialog.tsx
@@ -0,0 +1,248 @@
+import { useCallback, useEffect, useRef, useState } from 'react';
+import { KeyRound, Loader2, ShieldAlert } from 'lucide-react';
+import { useClient } from 'hooks/useClient';
+import { Button } from '@/components/ui/button';
+import { Input } from '@/components/ui/input';
+import { readableError } from './errors';
+
+/**
+ * Entering a DNS provider's API credential.
+ *
+ * ── The fields are NPM's, not ours ──
+ *
+ * `GET /nginx/certificates/dns-providers` returns a `credentials` TEMPLATE per provider, carrying that
+ * provider's own field names — one token for Cloudflare, a key and a secret for others. So the form is
+ * GENERATED rather than written per provider, and it stays right for providers nobody here has heard of.
+ *
+ * When the template cannot be fetched — no NPM connection yet, or a provider it does not support — the
+ * fallback is a single box in `key = value` form, which is the shape certbot wants anyway. Worse to use
+ * and not wrong, which is the correct direction for a fallback.
+ *
+ * ── Narrow versus broad, and why it is not read versus write ──
+ *
+ * Both can issue certificates, because a DNS-01 challenge WRITES a TXT record — there is no read-only
+ * credential that works, and offering one would produce a setup that looks configured and fails at the
+ * first renewal, sixty days later. What differs is what else the key can do if it leaks.
+ */
+
+type NpmProvider = { id: string; name: string; credentials: string };
+
+/**
+ * Pull field names out of certbot's ini template.
+ *
+ * `dns_cloudflare_api_token = <token>` → `dns_cloudflare_api_token`. Anything that is not a `key = value`
+ * line is skipped rather than guessed at.
+ */
+const fieldsFromTemplate = (template: string): string[] =>
+  template
+    .split('\n')
+    .map((line) => line.split('=')[0]?.trim())
+    .filter((key): key is string => !!key && /^[a-z0-9_]+$/i.test(key));
+
+/** `dns_cloudflare_api_token` → `Api token`. The prefix is noise once the provider is named above. */
+const labelFor = (field: string, provider: string): string => {
+  const stripped = field.replace(new RegExp(`^dns_${provider}_`, 'i'), '').replace(/^dns_/, '');
+  const words = stripped.replace(/_/g, ' ').trim();
+  return words.charAt(0).toUpperCase() + words.slice(1);
+};
+
+type Props = {
+  provider: string;
+  hasExisting: boolean;
+  onClose: () => void;
+  onSaved: () => void;
+};
+
+export const CredentialDialog = ({ provider, hasExisting, onClose, onSaved }: Props) => {
+  const client = useClient();
+  const clientRef = useRef(client);
+  clientRef.current = client;
+
+  const [fields, setFields] = useState<string[] | null>(null);
+  const [values, setValues] = useState<Record<string, string>>({});
+  const [raw, setRaw] = useState('');
+  const [scope, setScope] = useState<'narrow' | 'broad'>('narrow');
+  const [label, setLabel] = useState('');
+  const [saving, setSaving] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [forbidden, setForbidden] = useState(false);
+
+  const loadTemplate = useCallback(async () => {
+    try {
+      const list = await clientRef.current.get<NpmProvider[]>(
+        '/proxy-manager/npm/nginx/certificates/dns-providers',
+      );
+      const match = list.find((entry) => entry.id.toLowerCase() === provider.toLowerCase());
+      setFields(match ? fieldsFromTemplate(match.credentials) : []);
+    } catch {
+      // No connection, or NPM does not know this provider. The free-form box covers both.
+      setFields([]);
+    }
+  }, [provider]);
+
+  useEffect(() => {
+    void loadTemplate();
+  }, [loadTemplate]);
+
+  const save = async () => {
+    setSaving(true);
+    setError(null);
+    try {
+      const entered =
+        fields && fields.length > 0
+          ? values
+          : Object.fromEntries(
+              raw
+                .split('\n')
+                .map((line) => {
+                  const index = line.indexOf('=');
+                  return index === -1 ? null : [line.slice(0, index).trim(), line.slice(index + 1).trim()];
+                })
+                .filter((pair): pair is [string, string] => !!pair && !!pair[0] && !!pair[1]),
+            );
+
+      await clientRef.current.put(`/proxy-manager/_config/dns-providers/${encodeURIComponent(provider)}`, {
+        fields: entered,
+        scope,
+        label: label.trim() || undefined,
+      });
+      onSaved();
+    } catch (caught) {
+      if ((caught as { status?: number })?.status === 403) setForbidden(true);
+      else setError(readableError(caught, 'Could not save that.'));
+    } finally {
+      setSaving(false);
+    }
+  };
+
+  const generated = fields && fields.length > 0;
+  const filled = generated ? fields.some((f) => values[f]?.trim()) : raw.trim().length > 0;
+
+  return (
+    <div className="absolute inset-0 z-50 flex items-center justify-center bg-black/50 p-4" onClick={onClose}>
+      <div
+        className="flex max-h-full w-full max-w-md flex-col gap-3 overflow-auto rounded-lg border bg-background p-4"
+        onClick={(ev) => ev.stopPropagation()}
+      >
+        <div className="flex items-center gap-2">
+          <KeyRound className="size-4 text-muted-foreground" />
+          <span className="text-sm font-medium">
+            {hasExisting ? 'Replace' : 'Add'} the {provider} API key
+          </span>
+        </div>
+
+        {forbidden ? (
+          <>
+            <p className="flex items-center gap-2 text-sm text-muted-foreground">
+              <ShieldAlert className="size-4" /> Only the server owner can store a DNS credential.
+            </p>
+            <p className="text-[11px] leading-relaxed text-muted-foreground">
+              It can rewrite every record for a domain, which is more than the proxy login already kept here.
+            </p>
+          </>
+        ) : (
+          <>
+            {fields === null ? (
+              <p className="text-xs text-muted-foreground">Looking up what {provider} needs…</p>
+            ) : generated ? (
+              fields.map((field) => (
+                <label key={field} className="flex flex-col gap-1">
+                  <span className="text-xs font-medium">{labelFor(field, provider)}</span>
+                  <Input
+                    value={values[field] ?? ''}
+                    onChange={(ev) => setValues((prev) => ({ ...prev, [field]: ev.target.value }))}
+                    placeholder={hasExisting ? 'unchanged' : field}
+                    type="password"
+                    autoComplete="off"
+                    spellCheck={false}
+                  />
+                </label>
+              ))
+            ) : (
+              <label className="flex flex-col gap-1">
+                <span className="text-xs font-medium">Credential</span>
+                <textarea
+                  value={raw}
+                  onChange={(ev) => setRaw(ev.target.value)}
+                  rows={4}
+                  spellCheck={false}
+                  placeholder={`dns_${provider}_api_key = …`}
+                  className="rounded-md border bg-transparent p-2 font-mono text-xs"
+                />
+                <span className="text-[11px] leading-relaxed text-muted-foreground">
+                  One `name = value` per line. Officer could not fetch this provider's field names from Nginx Proxy
+                  Manager, so they are yours to supply — its own documentation lists them.
+                </span>
+              </label>
+            )}
+
+            <fieldset className="flex flex-col gap-1.5 rounded-lg border p-2.5">
+              <legend className="px-1 text-xs font-medium">What this key can do</legend>
+              {(
+                [
+                  {
+                    value: 'narrow' as const,
+                    title: 'Certificates only',
+                    hint: 'Scoped by the provider to DNS edits, ideally on just these zones. Enough to prove ownership and get a certificate. Not every provider can scope a key — some only issue account-wide ones.',
+                  },
+                  {
+                    value: 'broad' as const,
+                    title: 'Full DNS access',
+                    hint: 'Also lets an agent create and change records for you when asked. Everything the narrow key does, plus everything else that key can reach if it leaks.',
+                  },
+                ]
+              ).map((option) => (
+                <label key={option.value} className="flex cursor-pointer items-start gap-2">
+                  <input
+                    type="radio"
+                    name="scope"
+                    className="mt-1"
+                    checked={scope === option.value}
+                    onChange={() => setScope(option.value)}
+                  />
+                  <span className="min-w-0">
+                    <span className="block text-xs">{option.title}</span>
+                    <span className="block text-[11px] leading-relaxed text-muted-foreground">{option.hint}</span>
+                  </span>
+                </label>
+              ))}
+              {/* The correction that stops somebody creating a read-only key and finding out in sixty days. */}
+              <p className="px-1 text-[11px] leading-relaxed text-muted-foreground">
+                There is no read-only option, and that is not an omission: proving you own a domain means writing a
+                record into it, so any key that can get a certificate can write.
+              </p>
+            </fieldset>
+
+            <label className="flex flex-col gap-1">
+              <span className="text-xs font-medium">Label (optional)</span>
+              <Input
+                value={label}
+                onChange={(ev) => setLabel(ev.target.value)}
+                placeholder="which key this is, for when you rotate it"
+                autoComplete="off"
+              />
+            </label>
+
+            {error && <p className="text-xs text-destructive">{error}</p>}
+
+            <p className="text-[11px] leading-relaxed text-muted-foreground">
+              Stored encrypted under this plugin's own key and never returned by the API — not to a member, not to
+              you. To change it, enter a new one.
+            </p>
+          </>
+        )}
+
+        <div className="flex justify-end gap-2">
+          <Button type="button" variant="ghost" size="sm" onClick={onClose}>
+            {forbidden ? 'Close' : 'Cancel'}
+          </Button>
+          {!forbidden && (
+            <Button type="button" size="sm" onClick={() => void save()} disabled={!filled || saving}>
+              {saving ? <Loader2 className="size-3.5 animate-spin" /> : null} Save
+            </Button>
+          )}
+        </div>
+      </div>
+    </div>
+  );
+};
diff --git a/web/DetailPanel.tsx b/web/DetailPanel.tsx
index 7031135..0fa6e8b 100644
--- a/web/DetailPanel.tsx
+++ b/web/DetailPanel.tsx
@@ -7,6 +7,7 @@ import { CertificatesPanel } from './CertificatesPanel';
 import { ConnectionPanel } from './ConnectionPanel';
 import { ListSection, REDIRECTIONS, STREAMS, DEAD_HOSTS, ACCESS_LISTS } from './ListSection';
 import { PlannedSection } from './PlannedSection';
+import { DomainsSection } from './DomainsSection';
 import { useNpmChanged } from './channel';
 
 /**
@@ -62,6 +63,10 @@ export const DetailPanel = () => {
   const planned = SECTIONS.find((s) => s.key === section && s.planned);
   if (planned) return <PlannedSection section={planned} />;
 
+  // Domains is exempt from the connection check: it asks public DNS and reads Officer's own rows, so it
+  // works before NPM is connected at all — and telling somebody to connect NPM first would be false.
+  if (section === 'domains') return <DomainsSection />;
+
   if (!configured || section === 'connection') return <ConnectionPanel />;
 
   switch (section) {
diff --git a/web/DomainsSection.tsx b/web/DomainsSection.tsx
new file mode 100644
index 0000000..877858f
--- /dev/null
+++ b/web/DomainsSection.tsx
@@ -0,0 +1,311 @@
+import { useCallback, useEffect, useRef, useState } from 'react';
+import { CheckCircle2, KeyRound, Loader2, Network, RefreshCw, Search, Trash2, TriangleAlert } from 'lucide-react';
+import { useClient } from 'hooks/useClient';
+import { Button } from '@/components/ui/button';
+import { Input } from '@/components/ui/input';
+import { readableError } from './errors';
+import { CredentialDialog } from './CredentialDialog';
+
+/**
+ * Domains, and the DNS credentials that go with them — one screen, deliberately.
+ *
+ * ── Why not two sections ──
+ *
+ * A provider serves many domains, so the two are not the same list. But a person thinks in DOMAINS: the
+ * provider is something the check discovers, and the key is a property of the provider that only ever
+ * matters as an answer to "can Officer do anything for THIS domain". Two tabs would make you hold the join
+ * in your head, and the providers tab would be two rows most of the time.
+ *
+ * So the key is entered from the domain row that needs one, and stored against the provider — add it for
+ * `officer.dev` and every other Cloudflare domain in the list turns green at once, which is the correct
+ * surprise.
+ *
+ * ── The check runs before you commit ──
+ *
+ * Typing a domain and pressing Check tells you who runs its DNS and where it points, without storing
+ * anything. That ordering matters: the answer is usually the reason you would or would not add it, and a
+ * list of unchecked rows is a list somebody has to remember to go back to.
+ */
+
+type DomainRow = {
+  id: number;
+  domain: string;
+  dnsProvider: string | null;
+  pointsTo: string | null;
+  resolvedIps: string[];
+  lastCheckedAt: string | null;
+  hasCredential: boolean;
+  credentialScope: string | null;
+};
+
+type Check = {
+  domain: string;
+  nameservers: string[];
+  dnsProvider: string | null;
+  resolvedIps: string[];
+  pointsTo: 'here' | 'private' | 'elsewhere' | 'nowhere' | 'unknown';
+  maybeProxied: boolean;
+  machineIp: string | null;
+};
+
+const HINT = 'text-[11px] leading-relaxed text-muted-foreground';
+
+/**
+ * The verdict, in a sentence.
+ *
+ * Five outcomes rather than two, because "does it point here" has more than two honest answers and the
+ * missing ones are the interesting ones: a tailnet name resolving to `100.64.x` is CORRECT and would read
+ * as broken against a public-IP comparison, and a proxied domain resolves to the proxy rather than to us.
+ */
+const VERDICT: Record<Check['pointsTo'], { text: string; tone: string }> = {
+  here: { text: 'Points at this machine', tone: 'text-emerald-600 dark:text-emerald-400' },
+  private: { text: 'Points inside a private network', tone: 'text-sky-600 dark:text-sky-400' },
+  elsewhere: { text: 'Points somewhere else', tone: 'text-amber-600 dark:text-amber-400' },
+  nowhere: { text: 'Does not resolve yet', tone: 'text-muted-foreground' },
+  unknown: { text: 'Resolves — could not tell if it is this machine', tone: 'text-muted-foreground' },
+};
+
+const verdictOf = (value: string | null) => (value && value in VERDICT ? VERDICT[value as Check['pointsTo']] : null);
+
+const AddDomain = ({ onAdded }: { onAdded: () => void }) => {
+  const client = useClient();
+  const clientRef = useRef(client);
+  clientRef.current = client;
+
+  const [domain, setDomain] = useState('');
+  const [check, setCheck] = useState<Check | null>(null);
+  const [busy, setBusy] = useState<'check' | 'add' | null>(null);
+  const [error, setError] = useState<string | null>(null);
+
+  const run = async () => {
+    setBusy('check');
+    setError(null);
+    setCheck(null);
+    try {
+      setCheck(await clientRef.current.get<Check>(`/proxy-manager/domains/check?domain=${encodeURIComponent(domain)}`));
+    } catch (caught) {
+      setError(readableError(caught, 'Could not look that up.'));
+    } finally {
+      setBusy(null);
+    }
+  };
+
+  const add = async () => {
+    setBusy('add');
+    setError(null);
+    try {
+      await clientRef.current.post('/proxy-manager/domains', { domain });
+      setDomain('');
+      setCheck(null);
+      onAdded();
+    } catch (caught) {
+      setError(readableError(caught, 'Could not add that.'));
+    } finally {
+      setBusy(null);
+    }
+  };
+
+  const verdict = check && VERDICT[check.pointsTo];
+
+  return (
+    <div className="flex flex-col gap-2 border-b p-3">
+      <div className="flex items-center gap-2">
+        <Input
+          value={domain}
+          onChange={(ev) => {
+            setDomain(ev.target.value);
+            setCheck(null);
+          }}
+          onKeyDown={(ev) => {
+            if (ev.key === 'Enter' && domain.trim() && busy === null) void run();
+          }}
+          placeholder="example.com"
+          autoComplete="off"
+          spellCheck={false}
+          className="h-8"
+        />
+        <Button type="button" variant="outline" size="sm" onClick={() => void run()} disabled={!domain.trim() || busy !== null}>
+          {busy === 'check' ? <Loader2 className="size-3.5 animate-spin" /> : <Search className="size-3.5" />}
+          Check
+        </Button>
+        {/* Adding is only offered AFTER a check, so nothing lands on the list unexamined. */}
+        {check && (
+          <Button type="button" size="sm" onClick={() => void add()} disabled={busy !== null}>
+            {busy === 'add' ? <Loader2 className="size-3.5 animate-spin" /> : null}
+            Add
+          </Button>
+        )}
+      </div>
+
+      {check && verdict && (
+        <div className="rounded-lg border p-2.5 text-xs">
+          <p className={`flex items-center gap-1.5 ${verdict.tone}`}>
+            {check.pointsTo === 'here' ? <CheckCircle2 className="size-3.5" /> : <TriangleAlert className="size-3.5" />}
+            {verdict.text}
+            {check.maybeProxied && ' — possibly through its provider'}
+          </p>
+          <p className={`mt-1 ${HINT}`}>
+            {check.dnsProvider ? (
+              <>
+                DNS is run by <strong>{check.dnsProvider}</strong>.
+              </>
+            ) : check.nameservers.length ? (
+              <>Nameservers not recognised: {check.nameservers.join(', ')}.</>
+            ) : (
+              <>No nameservers found.</>
+            )}
+            {check.resolvedIps.length > 0 && <> Resolves to {check.resolvedIps.join(', ')}.</>}
+            {check.machineIp && <> This machine is {check.machineIp}.</>}
+          </p>
+          {/* The registrar/DNS-host distinction, said once and where it will be misread otherwise. */}
+          {check.dnsProvider && (
+            <p className={`mt-1 ${HINT}`}>
+              That is where the DNS is hosted, which may not be where you bought the domain — it is the one that
+              matters, because its API is what can prove ownership for a certificate.
+            </p>
+          )}
+        </div>
+      )}
+
+      {error && <p className="text-xs text-destructive">{error}</p>}
+    </div>
+  );
+};
+
+export const DomainsSection = () => {
+  const client = useClient();
+  const clientRef = useRef(client);
+  clientRef.current = client;
+
+  const [rows, setRows] = useState<DomainRow[] | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [busyId, setBusyId] = useState<number | null>(null);
+  const [keyFor, setKeyFor] = useState<DomainRow | null>(null);
+
+  const load = useCallback(async () => {
+    try {
+      setRows(await clientRef.current.get<DomainRow[]>('/proxy-manager/domains'));
+      setError(null);
+    } catch (caught) {
+      setError(readableError(caught, 'Could not load domains.'));
+    }
+  }, []);
+
+  useEffect(() => {
+    void load();
+  }, [load]);
+
+  const recheck = async (row: DomainRow) => {
+    setBusyId(row.id);
+    try {
+      await clientRef.current.post(`/proxy-manager/domains/${row.id}/recheck`, {});
+      await load();
+    } catch (caught) {
+      setError(readableError(caught, 'Could not re-check that.'));
+    } finally {
+      setBusyId(null);
+    }
+  };
+
+  const remove = async (row: DomainRow) => {
+    setBusyId(row.id);
+    try {
+      await clientRef.current.delete(`/proxy-manager/domains/${row.id}`);
+      await load();
+    } catch (caught) {
+      setError(readableError(caught, 'Could not remove that.'));
+    } finally {
+      setBusyId(null);
+    }
+  };
+
+  if (!rows) {
+    return <div className="flex size-full items-center justify-center p-6 text-sm text-muted-foreground">Loading…</div>;
+  }
+
+  return (
+    <div className="flex size-full flex-col">
+      <AddDomain onAdded={() => void load()} />
+
+      {error && <p className="border-b px-3 py-2 text-xs text-destructive">{error}</p>}
+
+      {rows.length === 0 ? (
+        <div className="flex flex-1 flex-col items-center justify-center gap-2 p-8 text-center">
+          <Network className="size-8 text-muted-foreground" />
+          <p className="text-sm text-muted-foreground">No domains yet.</p>
+          <p className={`max-w-sm ${HINT}`}>
+            Add the ones this machine is responsible for. Officer will remember who runs their DNS, which is what
+            it needs in order to get certificates for names that are not reachable from the internet.
+          </p>
+        </div>
+      ) : (
+        <ul className="flex-1 overflow-auto">
+          {rows.map((row) => {
+            const verdict = verdictOf(row.pointsTo);
+            return (
+              <li key={row.id} className="flex items-start gap-2 border-b px-3 py-2.5">
+                <Network className="mt-0.5 size-4 shrink-0 text-muted-foreground" />
+
+                <span className="min-w-0 flex-1">
+                  <span className="block truncate text-sm">{row.domain}</span>
+                  <span className={`block truncate text-xs ${verdict?.tone ?? 'text-muted-foreground'}`}>
+                    {verdict?.text ?? 'Not checked'}
+                    {row.resolvedIps.length > 0 && ` · ${row.resolvedIps.join(', ')}`}
+                  </span>
+                  <span className={`block truncate ${HINT}`}>
+                    {row.dnsProvider ? `DNS: ${row.dnsProvider}` : 'DNS provider not recognised'}
+                    {row.dnsProvider &&
+                      (row.hasCredential ? ` · key stored (${row.credentialScope})` : ' · no key yet')}
+                    {row.lastCheckedAt && ` · checked ${new Date(row.lastCheckedAt).toLocaleString()}`}
+                  </span>
+                </span>
+
+                {/* Offered only when we know WHICH provider to store it against. */}
+                {row.dnsProvider && (
+                  <button
+                    type="button"
+                    title={row.hasCredential ? 'Replace the API key' : 'Add an API key'}
+                    onClick={() => setKeyFor(row)}
+                    className={row.hasCredential ? 'text-emerald-500' : 'text-muted-foreground hover:text-foreground'}
+                  >
+                    <KeyRound className="size-4" />
+                  </button>
+                )}
+                <button
+                  type="button"
+                  title="Check again"
+                  onClick={() => void recheck(row)}
+                  disabled={busyId === row.id}
+                  className="text-muted-foreground hover:text-foreground disabled:opacity-50"
+                >
+                  <RefreshCw className={`size-4 ${busyId === row.id ? 'animate-spin' : ''}`} />
+                </button>
+                <button
+                  type="button"
+                  title="Forget this domain — changes nothing at the registrar"
+                  onClick={() => void remove(row)}
+                  disabled={busyId === row.id}
+                  className="text-muted-foreground hover:text-destructive disabled:opacity-50"
+                >
+                  <Trash2 className="size-4" />
+                </button>
+              </li>
+            );
+          })}
+        </ul>
+      )}
+
+      {keyFor?.dnsProvider && (
+        <CredentialDialog
+          provider={keyFor.dnsProvider}
+          hasExisting={keyFor.hasCredential}
+          onClose={() => setKeyFor(null)}
+          onSaved={() => {
+            setKeyFor(null);
+            void load();
+          }}
+        />
+      )}
+    </div>
+  );
+};
diff --git a/web/PlannedSection.tsx b/web/PlannedSection.tsx
index 6bcb930..e8fa8e7 100644
--- a/web/PlannedSection.tsx
+++ b/web/PlannedSection.tsx
@@ -13,16 +13,14 @@ import type { Section } from './sections';
  * the full design; this is the two sentences that fit on a screen.
  */
 
-const COPY: Partial<Record<Section['key'], { what: string; why: string }>> = {
-  domains: {
-    what: 'The domains you manage on this machine, and who each one is registered with.',
-    why: 'Right now that list lives in a document somebody edits by hand, which is right on the day it is written. Officer knowing it for real is what lets a certificate be issued without being told the same facts again.',
-  },
-  'dns-providers': {
-    what: 'An API key per registrar — Cloudflare, GoDaddy, whoever — kept in the secret store and never handed back out.',
-    why: 'This is what makes HTTPS possible on a hostname that only exists on your private network. Let’s Encrypt cannot visit a private address, so the only proof it accepts is a DNS record, and placing one needs the registrar’s API.',
-  },
-};
+/**
+ * **Empty, and the component stays.**
+ *
+ * `domains` and `dns-providers` were both here and both got built, which is the outcome this was for. The
+ * mechanism is worth keeping for the next agreed-and-unbuilt section: a nav that shows where the plugin is
+ * going is more useful than one that only shows where it is.
+ */
+const COPY: Partial<Record<Section['key'], { what: string; why: string }>> = {};
 
 export const PlannedSection = ({ section }: { section: Section }) => {
   const copy = COPY[section.key];
diff --git a/web/sections.ts b/web/sections.ts
index 2a1c558..d1c401d 100644
--- a/web/sections.ts
+++ b/web/sections.ts
@@ -1,5 +1,5 @@
 import type { LucideIcon } from 'lucide-react';
-import { Globe, Cable, Radio, FileX2, Users, ShieldCheck, Plug, Network, KeyRound } from 'lucide-react';
+import { Globe, Cable, Radio, FileX2, Users, ShieldCheck, Plug, Network } from 'lucide-react';
 
 /**
  * The sections.
@@ -22,6 +22,14 @@ import { Globe, Cable, Radio, FileX2, Users, ShieldCheck, Plug, Network, KeyRoun
  * Everything above `domains` is a thing NPM owns and this reads. From `domains` down is OFFICER's own —
  * what it knows about your domains, the DNS credentials it holds, and where NPM is. Those are not NPM
  * concepts and should not pretend to be.
+ *
+ * ── Domains and DNS Providers are ONE section ──
+ *
+ * They were briefly two. A provider serves many domains, so the lists are genuinely different — but a
+ * person thinks in domains, the provider is something the check discovers, and a key only ever matters as
+ * the answer to "can Officer do anything for THIS domain". Two tabs would make somebody hold that join in
+ * their head, and the providers tab would be two rows most of the time. So the key is entered from the
+ * domain row that needs one and stored against its provider.
  */
 
 export type SectionKey =
@@ -32,7 +40,6 @@ export type SectionKey =
   | 'dead-hosts'
   | 'access-lists'
   | 'domains'
-  | 'dns-providers'
   | 'connection';
 
 export type Section = {
@@ -103,17 +110,8 @@ export const SECTIONS: Section[] = [
     key: 'domains',
     label: 'Domains',
     icon: Network,
-    hint: 'The domains you manage, and who registers each',
-    path: null,
-    planned: true,
-  },
-  {
-    key: 'dns-providers',
-    label: 'DNS Providers',
-    icon: KeyRound,
-    hint: 'API keys, so a private hostname can still get TLS',
-    path: null,
-    planned: true,
+    hint: 'What you own, who runs its DNS, and the keys',
+    path: '/proxy-manager/domains',
   },
   {
     key: 'connection',