Cloudflare DNS Status #

Last audited: 2026-03-30

This file reflects the live Cloudflare state after the lith cutover. The primary frontend origin is 209.38.133.33.

Frontend Records On lith #

aesthetic.computer zone: aesthetic.computer, api, bills, data, feed, give, keeps, l5, news, p5, pals, papers, processing, sitemap, www
- data (A → 209.38.133.33, proxied) added 2026-06-29 — Linked Open Data / CIDOC CRM endpoint (crm.mjs); needs lith deploy to serve.
false.work zone: builds.false.work
jas.life zone: jas.life
justanothersystem.org zone: justanothersystem.org, www
kidlisp.com zone: kidlisp.com, www, buy, calm, device, keep, keeps, learn, pj, top
notepat.com zone: notepat.com, www
prompt.ac zone: prompt.ac, api, l5, p5, papers, processing, sitemap
- www MISSING as of 2026-07-06 — falls into the *.prompt.ac → 100:: Worker wildcard and 522s. Fix: add www A → 209.38.133.33 (proxied); Caddyfile already has the www→apex redirect.
quiltnet.org zone: quiltnet.org, www
sotce.net zone: sotce.net, www

aesthetic.computer keeps its non-lith service records for PDS, session, silo, oven, spaces/CDN, Auth0, Shopify, Stripe, and Cloudflare Worker endpoints.
prompt.ac keeps *.prompt.ac -> 100:: for the Worker wildcard.
prompt.ac zone ruleset "prompt.ac bare-domain auto-redirect" (dynamic redirect, ruleset 99ad241726fe48ee9db29ba97f11ad4d) was DISABLED 2026-09-01: it 301'd every non-root path to aesthetic.computer at the edge, which now belongs to lith's resolver (server.mjs serves the HTML prompt shell for dotless piece paths, 302s live wg codes, 301s dotted paths). Re-enable it only if the shell has to be pulled — it supersedes the origin's routing.
sotce.net keeps chat.sotce.net -> 157.245.134.225 plus its mail/Auth0 records.

No production records in the audited zones point to aesthetic-computer.netlify.app.
No production records in the audited zones point to 75.2.60.5.
Legacy duckweedtri.aesthetic.computer and duckweedtri.prompt.ac were stale Netlify 404s during the audit and should resolve through lith-managed redirects instead.

inbound.aesthetic.computer A → 209.38.133.33, DNS-only (Cloudflare does not proxy SMTP). This is the "route to host" target of the Google Workspace default-routing rule that catches unknown @aesthetic.computer addresses; lith/mail-inbound.mjs (lith-mail.service, :25) files them as Amail. Caddy serves the same name over HTTPS only to hold its STARTTLS certificate.
The apex MX stays on Google (aspmx.l.google.com et al.) — one human mailbox, mail@aesthetic.computer, lives there.
Mail authentication for the apex (added 2026-09-14 — there was none before, so every mail@aesthetic.computer send had been unauthenticated): aesthetic.computer TXT "v=spf1 include:_spf.google.com ~all" and google._domainkey.aesthetic.computer TXT "v=DKIM1; …" (key generated in Admin → Gmail → Authenticate email; status "Authenticating email with DKIM"). DMARC stays p=none for now.