# System Administrator: Domains, DNS and a Healthy Server, Handled > The System Administrator is an AI system administrator in the Ai1 platform by MyZone AI that looks after your domains, DNS, source control access, hosting credentials and Ai1 server disk space, saves the current state before every change and waits for your approval on anything destructive or hard to undo. Canonical page: https://myzone.ai/pages/agents/ai-system-administrator-agent Part of Ai1, by MyZone AI. Book a System Admin walkthrough: https://calendly.com/d/ct6h-tcy-8qf/ai1-demo?a1=System%20Administrator&utm_source=myzone.ai&utm_medium=agent-page&utm_content=ai-system-administrator-agent-final Last updated: 2026-10-05. Reviewed by the MyZone AI team. Domains, DNS and access looked after, with a way back from every change. ## At a glance - **Domains:** Checked weekly for expiry and auto-renewal, with a warning in time to act - **DNS:** Changed only where you have given it edit access; otherwise it reads and reports - **Email authentication:** SPF, DKIM and DMARC checked against what your email provider expects - **Before every change:** The current state is saved, so there is always a way back - **Waits for your approval:** Deleting a DNS record, transferring a domain, removing a member or revoking a credential - **Keys and passwords:** Stored securely and never shown in a chat, a log or a document ## What the System Administrator does - **Keeps an eye on your domains:** Domain management starts with a weekly check of each domain for upcoming expiry and auto-renewal, warns you in time and can turn auto-renewal on. - **DNS management with a saved before-state:** Where you have given it edit access to your DNS, it adds, updates or investigates records after saving the current ones. Without that access it reads and reports what is needed. - **Checks your email authentication:** Compares your SPF, DKIM and DMARC records with what your email provider expects, then fixes the gap if it has DNS edit access or reports it if not. - **Manages source control access:** Invites team members, puts them in the right teams, tracks seat use and flags inactive accounts. Nobody is removed until you confirm. - **Rotates hosting credentials:** Creates a replacement key, stores it securely, confirms everything still works and retires the old key only after your go-ahead. Keys never appear in chat or logs. - **Diagnoses domain and DNS problems:** When a site will not load or email bounces, it finds the cause, explains it plainly and proposes a fix for your approval. - **Keeps server disk space healthy:** As part of server health monitoring, it owns routine cleanup and disk headroom on your Ai1 server, so it does not run out of space. - **Gives a quick server health check:** On request it takes a view-only health snapshot of your server, covering uptime, CPU, memory, disk space and running processes, with a simple ok, warning or critical verdict. Nothing is changed. ## How the System Administrator differs from a hosting control panel A control panel lets anyone change a record and keeps no note of what was there before. The System Administrator reads and saves the current state first, sets out exactly what it intends to do and waits for your approval on anything destructive or hard to undo. It checks your domains weekly, compares email records with your provider's requirements, rotates keys without ever showing them and records what it did and why. How this differs from the DevOps Agent (https://myzone.ai/pages/agents/ai-devops-agent): the DevOps Agent builds, releases and deploys your applications, while the System Administrator looks after what sits underneath: domains, DNS, credentials, access and server upkeep. ## How it works 1. **You ask** (Whenever you ask): Describe the domain, DNS, access, credential or server task in plain language. 2. **Snapshot** (Before anything changes): It reads and saves the current state before changing anything, which is your safety net. 3. **Diagnose or plan** (you approve) (Before any change is made): For an investigation it reports what it found. Anything destructive or hard to undo, such as deleting a record or revoking a key, waits for your explicit approval. 4. **Make the change** (Once the plan is clear): It applies the change in a way that is safe to retry, so nothing is done twice. 5. **Verify and log** (Right after the change): It confirms the change worked and records what was done and why. ## When to use it - **You need a subdomain for a new help centre:** With DNS edit access it creates the record, checks it resolves and logs it. Without access it tells you exactly what to add. - **Your emails keep landing in spam:** It checks your email authentication records against your provider's requirements and fixes or reports each gap. - **A new developer starts on Monday:** It checks there is a free seat, sends the source control invite, assigns the right teams and keeps a record. - **A hosting key is due for rotation:** It sets up the new key, proves it works, then waits for you before switching off the old one. - **The server is short of disk space:** It measures usage, runs a safe cleanup and confirms the space is back. ## What you get - Weekly domain expiry and auto-renewal checks - DNS records added, updated or diagnosed, with a saved before-state - An email authentication report with gaps fixed or listed - Source control seat audits and logged member changes - Rotated credentials, verified before the old key is retired - Disk cleanup on your Ai1 server with the result confirmed ## Example: DNS cutover preflight Example with a fictional company. Names, people and figures are invented to show the agent's output. Any resemblance to a real company or person is unintended. Industry facts are real and cited with their sources. What it was asked: Review our supplied DNS records and give us a safe, limited plan to move the help portal without changing our website or email. I compared a fictional client-supplied zone extract with a fictional target and prepared a change, verification, and rollback plan using normal DNS administration practice. I did not query or change any client DNS, inspect a live destination, or claim that the fictional records are operational. A person on the team approves the cutover; where DNS management is not connected, a person on the team makes every change. Run date: 30 September 2026. ### What it found - The supplied help-name A record conflicts with the proposed CNAME, so the two cannot be left together. - The requested cutover can be limited to the help subdomain; website and mail records stay outside scope. - No change should be scheduled until a live record snapshot, destination check, and change-window decision are complete. ### Sources - [RFC 1034, Domain Names: Concepts and Facilities, section 3.6.2](https://www.rfc-editor.org/rfc/rfc1034.html#section-3.6.2), RFC Editor (accessed 2026-09-30) - [RFC 2606, Reserved Top Level DNS Names, section 3](https://www.rfc-editor.org/rfc/rfc2606.html#section-3), RFC Editor (accessed 2026-09-30) - [RFC 5737, IPv4 Address Blocks Reserved for Documentation, section 3](https://www.rfc-editor.org/rfc/rfc5737.html#section-3), RFC Editor (accessed 2026-09-30) ## Guardrails - It reads the current state first and saves it, so every change has a way back. - Deleting DNS records, transferring a domain, removing a member or revoking a credential always waits for a person's approval. - It changes DNS only where you have given it edit access. Otherwise it reads and reports, and a person on your team makes the change. - Passwords and keys are stored securely and never shown in a chat, a log or a document. ## Frequently asked questions ### Can an AI agent manage our DNS records safely? Yes, where you have given it edit access. The System Administrator in Ai1 by MyZone AI saves your current records first, adds or updates the record, checks it resolves and logs the change, so it can be put back. Deleting a record waits for your approval. Without edit access it reads your records, diagnoses the problem and tells you exactly what to change, and a person on your team makes the change. ### How do I stop a business domain from expiring by accident? Check each domain for upcoming expiry and auto-renewal on a schedule. The System Administrator does this weekly, warns you in time to act and can turn auto-renewal on. Routine checks run on their own. Transferring a domain, deleting a DNS record, removing a person or revoking a credential waits for your explicit approval. ### What does server health monitoring cover for an Ai1 server? For the System Administrator, it means routine cleanup and disk headroom on your Ai1 server, so it does not run out of space. When space runs short it measures usage, runs a safe cleanup and confirms the space is back. It does not write code or ship releases. Your developers write the code and the DevOps Agent releases it. ### What does an AI system administrator handle that I would otherwise do myself? Domain renewals, DNS records, email authentication checks, source control invites and seat audits, hosting key rotation and disk cleanup on your Ai1 server. It checks first, logs every change and asks before anything risky. The seat audit lists everyone in your organization, compares them with your active teams and flags inactive or unassigned accounts. It waits for your instruction before removing anyone. ## More on this topic - [Locking Down AI Agents: The 10-Point Security Checklist Every CTO Needs](https://myzone.ai/pages/blog/ai-agent-security): AI agents are powerful,and vulnerable. Learn the 10 critical security steps to lock down your AI agents before they become your biggest liability. ## About Ai1 Ai1 is the AI operations platform by MyZone AI, where each client runs on its own private server. The System Administrator is included on every Ai1 level, including Developer Core, with no per-agent charge. It works alongside the other Ai1 agents on your account. Pricing: https://myzone.ai/pages/services/ai1-pricing. Security: https://myzone.ai/pages/security.