01 / DECISION
When this primitive earns a place
Use authoritative DNS to make ownership and routing observable before traffic reaches certificates, cache, or application logic.
02 / ARCHITECTURE
Build the smallest defensible path
Inventory apex, subdomain, email, and verification records; choose proxied versus DNS-only deliberately; then document TTL and rollback expectations.
- 01Name the contract
Use authoritative DNS to make ownership and routing observable before traffic reaches certificates, cache, or application logic.
- 02Add one primitive
Inventory apex, subdomain, email, and verification records; choose proxied versus DNS-only deliberately; then document TTL and rollback expectations.
- 03Capture failure evidence
Compare authoritative answers from multiple resolvers, verify DNSSEC state, and record the expected origin or Cloudflare edge path.
03 / REPRODUCE
Evidence before confidence
Compare authoritative answers from multiple resolvers, verify DNSSEC state, and record the expected origin or Cloudflare edge path.
dig +short example.com && dig +dnssec example.com04 / BOUNDARY
The production boundary
A green DNS dashboard does not prove the origin is healthy. Avoid deleting unknown records or changing nameservers without an exported baseline.
05 / FIRST-PARTY SOURCES
Keep first-party sources authoritative
Product behavior, limits, pricing, and availability can change. Re-check these sources before acting.