diff --git a/terraform/dns_ntxarms.tf b/terraform/dns_ntxarms.tf
index 9e1c08e..c792894 100644
--- a/terraform/dns_ntxarms.tf
+++ b/terraform/dns_ntxarms.tf
@@ -40,3 +40,41 @@ resource "powerdns_record" "ntxarms_mx" {
     "20 in2-smtp.messagingengine.com."
   ]
 }
+
+# Fastmail DKIM records
+resource "powerdns_record" "ntxarms_dkim_fm1" {
+  depends_on = [powerdns_zone.ntxarms_com]
+  zone       = "ntxarms.com."
+  name       = "fm1._domainkey.ntxarms.com."
+  type       = "CNAME"
+  ttl        = 3600
+  records    = ["fm1.ntxarms.com.dkim.fmhosted.com."]
+}
+
+resource "powerdns_record" "ntxarms_dkim_fm2" {
+  depends_on = [powerdns_zone.ntxarms_com]
+  zone       = "ntxarms.com."
+  name       = "fm2._domainkey.ntxarms.com."
+  type       = "CNAME"
+  ttl        = 3600
+  records    = ["fm2.ntxarms.com.dkim.fmhosted.com."]
+}
+
+resource "powerdns_record" "ntxarms_dkim_fm3" {
+  depends_on = [powerdns_zone.ntxarms_com]
+  zone       = "ntxarms.com."
+  name       = "fm3._domainkey.ntxarms.com."
+  type       = "CNAME"
+  ttl        = 3600
+  records    = ["fm3.ntxarms.com.dkim.fmhosted.com."]
+}
+
+# Fastmail SPF record
+resource "powerdns_record" "ntxarms_spf" {
+  depends_on = [powerdns_zone.ntxarms_com]
+  zone       = "ntxarms.com."
+  name       = "ntxarms.com."
+  type       = "TXT"
+  ttl        = 3600
+  records    = ["\"v=spf1 include:spf.messagingengine.com ?all\""]
+}
diff --git a/terraform/dns_powerdns_zones.tf b/terraform/dns_powerdns_zones.tf
index 7e8c2e3..4d5ef2f 100644
--- a/terraform/dns_powerdns_zones.tf
+++ b/terraform/dns_powerdns_zones.tf
@@ -46,3 +46,10 @@ resource "powerdns_zone" "qth_social" {
   soa_edit_api = "DEFAULT"
   nameservers  = ["ns1.as393837.net.", "ns-global.kjsl.com."]
 }
+
+resource "powerdns_zone" "towerops_net" {
+  name         = "towerops.net."
+  kind         = "Primary"
+  soa_edit_api = "DEFAULT"
+  nameservers  = ["ns1.as393837.net.", "ns-global.kjsl.com."]
+}
diff --git a/terraform/dns_towerops.tf b/terraform/dns_towerops.tf
index c3805d3..94d5303 100644
--- a/terraform/dns_towerops.tf
+++ b/terraform/dns_towerops.tf
@@ -1,38 +1,62 @@
-# DNSimple DNS records for towerops.net
+# PowerDNS records for towerops.net
 # SendGrid email authentication records
 
+# SOA record for towerops.net
+resource "powerdns_record" "towerops_soa" {
+  depends_on = [powerdns_zone.towerops_net]
+  zone       = "towerops.net."
+  name       = "towerops.net."
+  type       = "SOA"
+  ttl        = 3600
+  records    = ["ns1.as393837.net. graham.mcintire.me. 0 10800 3600 604800 3600"]
+}
+
+# Root A record
+resource "powerdns_record" "towerops_root_a" {
+  depends_on = [powerdns_zone.towerops_net]
+  zone       = "towerops.net."
+  name       = "towerops.net."
+  type       = "A"
+  ttl        = 3600
+  records    = ["204.110.191.195"]
+}
+
 # SendGrid domain CNAME
-resource "dnsimple_zone_record" "towerops_dnsimple_sendgrid_domain" {
-  zone_name = "towerops.net"
-  name      = "em6505"
-  type      = "CNAME"
-  value     = "u177982.wl233.sendgrid.net"
-  ttl       = 600
+resource "powerdns_record" "towerops_sendgrid_domain" {
+  depends_on = [powerdns_zone.towerops_net]
+  zone       = "towerops.net."
+  name       = "em6505.towerops.net."
+  type       = "CNAME"
+  ttl        = 600
+  records    = ["u177982.wl233.sendgrid.net."]
 }
 
 # SendGrid DKIM key 1
-resource "dnsimple_zone_record" "towerops_dnsimple_sendgrid_dkim1" {
-  zone_name = "towerops.net"
-  name      = "s1._domainkey"
-  type      = "CNAME"
-  value     = "s1.domainkey.u177982.wl233.sendgrid.net"
-  ttl       = 600
+resource "powerdns_record" "towerops_sendgrid_dkim1" {
+  depends_on = [powerdns_zone.towerops_net]
+  zone       = "towerops.net."
+  name       = "s1._domainkey.towerops.net."
+  type       = "CNAME"
+  ttl        = 600
+  records    = ["s1.domainkey.u177982.wl233.sendgrid.net."]
 }
 
 # SendGrid DKIM key 2
-resource "dnsimple_zone_record" "towerops_dnsimple_sendgrid_dkim2" {
-  zone_name = "towerops.net"
-  name      = "s2._domainkey"
-  type      = "CNAME"
-  value     = "s2.domainkey.u177982.wl233.sendgrid.net"
-  ttl       = 600
+resource "powerdns_record" "towerops_sendgrid_dkim2" {
+  depends_on = [powerdns_zone.towerops_net]
+  zone       = "towerops.net."
+  name       = "s2._domainkey.towerops.net."
+  type       = "CNAME"
+  ttl        = 600
+  records    = ["s2.domainkey.u177982.wl233.sendgrid.net."]
 }
 
 # DMARC policy
-resource "dnsimple_zone_record" "towerops_dnsimple_dmarc" {
-  zone_name = "towerops.net"
-  name      = "_dmarc"
-  type      = "TXT"
-  value     = "v=DMARC1; p=none;"
-  ttl       = 600
+resource "powerdns_record" "towerops_dmarc" {
+  depends_on = [powerdns_zone.towerops_net]
+  zone       = "towerops.net."
+  name       = "_dmarc.towerops.net."
+  type       = "TXT"
+  ttl        = 600
+  records    = ["\"v=DMARC1; p=none;\""]
 }