diff --git a/infrastructure/terraform/dynu/README.md b/infrastructure/terraform/dynu/README.md
index 4cc19fd..e71aceb 100644
--- a/infrastructure/terraform/dynu/README.md
+++ b/infrastructure/terraform/dynu/README.md
@@ -15,7 +15,9 @@ Dynu remains the authoritative DNS provider for existing records. Terraform here
 Use local `terraform.tfvars` (or provider-supported environment variables).
 
 - Required variable: `dynu_api_key`
+- Domain variable: `dynu_root_domain` (defaults to `lan.ddnsgeek.com`)
 - Optional placeholders for future provider auth changes: `dynu_username`, `dynu_password`
+- Import helper variable: `dynu_record_import_id` (set per record import operation)
 
 Never commit:
 
@@ -45,7 +47,7 @@ terraform plan
 ## Import workflow (one object at a time)
 
 ```bash
-terraform import dynu_domain.lan_ddnsgeek_com '<provider-specific-domain-import-id>'
+terraform import dynu_domain.lan_ddnsgeek_com '<provider-specific-domain-import-id-or-domain-name>'
 terraform state show dynu_domain.lan_ddnsgeek_com
 terraform plan
 ```
diff --git a/infrastructure/terraform/dynu/domains.tf b/infrastructure/terraform/dynu/domains.tf
index 4982023..033748c 100644
--- a/infrastructure/terraform/dynu/domains.tf
+++ b/infrastructure/terraform/dynu/domains.tf
@@ -1,5 +1,11 @@
 locals {
-  dynu_domain = "lan.ddnsgeek.com"
+  dynu_domain = var.dynu_root_domain
+}
+
+# Import-first resource skeleton for the production Dynu zone.
+# `name` is required by provider schema and can be reconciled after import.
+resource "dynu_domain" "lan_ddnsgeek_com" {
+  name = local.dynu_domain
 }
 
 # Import-first resource skeleton for the production Dynu zone.
diff --git a/infrastructure/terraform/dynu/imports.tf.example b/infrastructure/terraform/dynu/imports.tf.example
index 165213c..d41f3df 100644
--- a/infrastructure/terraform/dynu/imports.tf.example
+++ b/infrastructure/terraform/dynu/imports.tf.example
@@ -1,9 +1,10 @@
 # Copy this file to imports.tf and adjust IDs after confirming the
 # published provider docs for import ID formats.
+# For dynu_domain, import ID is commonly the root domain name.
 
 import {
   to = dynu_domain.lan_ddnsgeek_com
-  id = "REPLACE_WITH_DYNU_DOMAIN_IMPORT_ID"
+  id = var.dynu_root_domain
 }
 
 # DNS record imports are intentionally examples only because the provider
@@ -11,5 +12,5 @@ import {
 #
 # import {
 #   to = dynu_dns_record.grafana_lan_ddnsgeek_com
-#   id = "REPLACE_WITH_DYNU_RECORD_IMPORT_ID"
+#   id = var.dynu_record_import_id
 # }
diff --git a/infrastructure/terraform/dynu/records.tf b/infrastructure/terraform/dynu/records.tf
index 1aa7ca7..00847bd 100644
--- a/infrastructure/terraform/dynu/records.tf
+++ b/infrastructure/terraform/dynu/records.tf
@@ -1,7 +1,6 @@
 locals {
-  dynu_dns_records_catalog = {
+  dynu_dns_records_catalog_base = {
     auth = {
-      fqdn        = "auth.lan.ddnsgeek.com"
       hostname    = "auth"
       service     = "authelia"
       source      = "core/authelia/docker-compose.yml"
@@ -12,7 +11,6 @@ locals {
       proxied     = null
     }
     gitea = {
-      fqdn        = "gitea.lan.ddnsgeek.com"
       hostname    = "gitea"
       service     = "gitea"
       source      = "apps/gitea/docker-compose.yml"
@@ -23,7 +21,6 @@ locals {
       proxied     = null
     }
     gotify = {
-      fqdn        = "gotify.lan.ddnsgeek.com"
       hostname    = "gotify"
       service     = "gotify"
       source      = "monitoring/gotify/docker-compose.yml"
@@ -34,7 +31,6 @@ locals {
       proxied     = null
     }
     grafana = {
-      fqdn        = "grafana.lan.ddnsgeek.com"
       hostname    = "grafana"
       service     = "grafana"
       source      = "monitoring/grafana/docker-compose.yml"
@@ -45,7 +41,6 @@ locals {
       proxied     = null
     }
     familytree = {
-      fqdn        = "familytree.lan.ddnsgeek.com"
       hostname    = "familytree"
       service     = "gramps"
       source      = "apps/gramps/docker-compose.yml"
@@ -56,7 +51,6 @@ locals {
       proxied     = null
     }
     influxdb = {
-      fqdn        = "influxdb.lan.ddnsgeek.com"
       hostname    = "influxdb"
       service     = "influxdb"
       source      = "monitoring/influxdb/docker-compose.yml"
@@ -67,7 +61,6 @@ locals {
       proxied     = null
     }
     monitor_kuma = {
-      fqdn        = "monitor-kuma.lan.ddnsgeek.com"
       hostname    = "monitor-kuma"
       service     = "uptime-kuma"
       source      = "monitoring/uptime-kuma/docker-compose.yml"
@@ -78,7 +71,6 @@ locals {
       proxied     = null
     }
     mtls_bridge = {
-      fqdn        = "mtls-bridge.lan.ddnsgeek.com"
       hostname    = "mtls-bridge"
       service     = "mtls-bridge"
       source      = "monitoring/mtls-bridge/docker-compose.yml"
@@ -89,7 +81,6 @@ locals {
       proxied     = null
     }
     nextcloud = {
-      fqdn        = "nextcloud.lan.ddnsgeek.com"
       hostname    = "nextcloud"
       service     = "nextcloud-webapp"
       source      = "apps/nextcloud/docker-compose.yml"
@@ -100,7 +91,6 @@ locals {
       proxied     = null
     }
     node_red = {
-      fqdn        = "node-red.lan.ddnsgeek.com"
       hostname    = "node-red"
       service     = "node-red"
       source      = "monitoring/node-red/docker-compose.yml"
@@ -111,7 +101,6 @@ locals {
       proxied     = null
     }
     passbolt = {
-      fqdn        = "passbolt.lan.ddnsgeek.com"
       hostname    = "passbolt"
       service     = "passbolt-webapp"
       source      = "apps/passbolt/docker-compose.yml"
@@ -122,7 +111,6 @@ locals {
       proxied     = null
     }
     portainer = {
-      fqdn        = "portainer.lan.ddnsgeek.com"
       hostname    = "portainer"
       service     = "portainer"
       source      = "monitoring/portainer/docker-compose.yml"
@@ -133,7 +121,6 @@ locals {
       proxied     = null
     }
     prometheus = {
-      fqdn        = "prometheus.lan.ddnsgeek.com"
       hostname    = "prometheus"
       service     = "prometheus"
       source      = "monitoring/prometheus/docker-compose.yml"
@@ -143,9 +130,7 @@ locals {
       target      = null
       proxied     = null
     }
-
     searxng = {
-      fqdn        = "searxng.lan.ddnsgeek.com"
       hostname    = "searxng"
       service     = "searxng"
       source      = "apps/searxng/docker-compose.yml"
@@ -156,7 +141,6 @@ locals {
       proxied     = null
     }
     traefik = {
-      fqdn        = "traefik.lan.ddnsgeek.com"
       hostname    = "traefik"
       service     = "traefik"
       source      = "core/traefik/docker-compose.yml"
@@ -167,4 +151,11 @@ locals {
       proxied     = null
     }
   }
+
+  dynu_dns_records_catalog = {
+    for key, record in local.dynu_dns_records_catalog_base :
+    key => merge(record, {
+      fqdn = format("%s.%s", record.hostname, local.dynu_domain)
+    })
+  }
 }
diff --git a/infrastructure/terraform/dynu/terraform.tfvars.example b/infrastructure/terraform/dynu/terraform.tfvars.example
index 05632f8..0ba977f 100644
--- a/infrastructure/terraform/dynu/terraform.tfvars.example
+++ b/infrastructure/terraform/dynu/terraform.tfvars.example
@@ -2,3 +2,6 @@
 dynu_api_key  = "replace-with-dynu-api-key"
 dynu_username = null
 dynu_password = null
+
+dynu_root_domain = "lan.ddnsgeek.com"
+dynu_record_import_id = "REPLACE_WITH_DYNU_RECORD_IMPORT_ID"
diff --git a/infrastructure/terraform/dynu/variables.tf b/infrastructure/terraform/dynu/variables.tf
index 3614969..1379c57 100644
--- a/infrastructure/terraform/dynu/variables.tf
+++ b/infrastructure/terraform/dynu/variables.tf
@@ -1,3 +1,10 @@
+
+variable "dynu_root_domain" {
+  description = "Dynu root domain name to reconcile/import (for example: lan.ddnsgeek.com)."
+  type        = string
+  default     = "lan.ddnsgeek.com"
+}
+
 variable "dynu_api_key" {
   description = "Dynu API key/token used by the Dynu Terraform provider."
   type        = string
@@ -18,3 +25,9 @@ variable "dynu_password" {
   sensitive   = true
   default     = null
 }
+
+variable "dynu_record_import_id" {
+  description = "Placeholder import ID for a single dynu_dns_record during one-at-a-time reconciliation."
+  type        = string
+  default     = "REPLACE_WITH_DYNU_RECORD_IMPORT_ID"
+}