mention the domain name scheme

tsa/doc/naming-scheme.mdwn

+[[!toc levels=3]]
+
+Domain name scheme
+==================
+
+Tor uses two main domain names for things:
+
+ * `torproject.org`
+ * `torproject.net`
+
+There might be other domains managed by us or registered in the DNS,
+but they should eventually point to one of those, generally
+`torproject.org`.
+
+All TPA-managed machines and services on those machines should be
+under `torproject.org`. The name of the individual machines is
+detailed below.
+
+External services and machines *can* be hosted under
+`torproject.net`. In that case, the only association is a `CNAME` or
+`A` record pointing to the other machine.
+
+Machine naming scheme
+=====================
+
 There are multiple naming schemes in use:
 
  * onion species
@@ -5,7 +30,7 @@ There are multiple naming schemes in use:
  * location-based
 
 Onion species
-=============
+-------------
 
 [Wikipedia list of onion species][], preferably picking a first letter
 matching purpose (e.g. "m" for monitoring, "b" for backups, "p" for
@@ -22,7 +47,7 @@ hostname part
 > "mon" or smaller as its first three letters there either.
 
 Role
-====
+----
 
 Another naming scheme is `role-ID`, where:
 
@@ -36,7 +61,7 @@ Another naming scheme is `role-ID`, where:
    (e.g. `mon-01`, `mon-02`)
 
 Location
-========
+--------
 
 Another naming scheme used for virtual machines is `hoster-locN-ID`
 (example `hetzner-hel1-01`), where: