diff --git a/cmd/spinifex/cmd/service.go b/cmd/spinifex/cmd/service.go
index aff30c9b7..9eaf96611 100644
--- a/cmd/spinifex/cmd/service.go
+++ b/cmd/spinifex/cmd/service.go
@@ -852,7 +852,7 @@ var northstarStartCmd = &cobra.Command{
 			baseDirOverride: viper.GetString("base-dir"),
 		}, northstarStartDependencies{
 			loadConfig:        loadRequiredClusterConfig,
-			bootstrapBaseZone: northstar.BootstrapBaseZone,
+			bootstrapBaseZone: dns.BootstrapBaseZone,
 			newService: func(cfg *northstar.Config) (northstarStarter, error) {
 				return service.New("northstar", cfg)
 			},
diff --git a/spinifex/runtime/roles/northstar/bootstrap.go b/spinifex/domains/dns/bootstrap.go
similarity index 97%
rename from spinifex/runtime/roles/northstar/bootstrap.go
rename to spinifex/domains/dns/bootstrap.go
index 6f9f59788..f86ebd59e 100644
--- a/spinifex/runtime/roles/northstar/bootstrap.go
+++ b/spinifex/domains/dns/bootstrap.go
@@ -1,4 +1,4 @@
-package northstar
+package dns
 
 import (
 	"fmt"
@@ -10,7 +10,6 @@ import (
 
 	nsconfig "github.com/mulgadc/northstar/pkg/config"
 	"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
-	"github.com/mulgadc/spinifex/spinifex/domains/dns"
 )
 
 // baseZoneTXT is the marker TXT record seeded at the apex of the base zone.
@@ -77,7 +76,7 @@ func BootstrapBaseZone(configPath string, cluster *config.ClusterConfig) error {
 		SecretKey: sysCreds.SecretKey,
 	}
 
-	nameservers := dns.NameserverSeeds(cluster)
+	nameservers := NameserverSeeds(cluster)
 	slog.Info("northstar bootstrap: ensuring base zone",
 		"domain", domain, "nameservers", len(nameservers), "multi_node", len(nameservers) > 1)
 
diff --git a/spinifex/runtime/roles/northstar/bootstrap_test.go b/spinifex/domains/dns/bootstrap_test.go
similarity index 91%
rename from spinifex/runtime/roles/northstar/bootstrap_test.go
rename to spinifex/domains/dns/bootstrap_test.go
index 3c751dd66..f46bc0d8d 100644
--- a/spinifex/runtime/roles/northstar/bootstrap_test.go
+++ b/spinifex/domains/dns/bootstrap_test.go
@@ -1,4 +1,4 @@
-package northstar
+package dns
 
 import (
 	"fmt"
@@ -7,7 +7,6 @@ import (
 	"net/http/httptest"
 	"os"
 	"path/filepath"
-	"strconv"
 	"strings"
 	"sync"
 	"testing"
@@ -20,44 +19,6 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-// fakeS3 is a minimal mutable path-style S3 endpoint (HEAD/PUT/GET) for the
-// bootstrap happy-path test.
-func fakeS3(t *testing.T, bucket string) (endpoint string, objects map[string]string) {
-	t.Helper()
-	var mu sync.Mutex
-	objects = map[string]string{}
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		key := strings.TrimPrefix(r.URL.Path, "/"+bucket+"/")
-		mu.Lock()
-		defer mu.Unlock()
-		switch r.Method {
-		case http.MethodHead:
-			if _, ok := objects[key]; ok {
-				w.WriteHeader(http.StatusOK)
-			} else {
-				w.WriteHeader(http.StatusNotFound)
-			}
-		case http.MethodPut:
-			body, _ := io.ReadAll(r.Body)
-			objects[key] = string(body)
-			w.WriteHeader(http.StatusOK)
-		case http.MethodGet:
-			body, ok := objects[key]
-			if !ok {
-				http.Error(w, "not found", http.StatusNotFound)
-				return
-			}
-			w.Header().Set("Content-Length", strconv.Itoa(len(body)))
-			_, _ = w.Write([]byte(body))
-		default:
-			http.Error(w, "unsupported", http.StatusMethodNotAllowed)
-		}
-	}))
-	t.Cleanup(srv.Close)
-	return srv.URL, objects
-}
-
 func TestBootstrapBaseZone(t *testing.T) {
 	endpoint, objects := fakeS3(t, "northstar")