DNS incident diagnosis: Cloudflare migration dropped gateway/staging-api/docs subdomains
the Gateway's admin domain returned DNS_PROBE_FINISHED_NXDOMAIN. From the bash sandbox I resolved the subdomain against [ip] (global NXDOMAIN, so not a local glitch) and checked NS records, proving the domain is registered at Namecheap but its authoritative DNS is Cloudflare (jule/simon.ns.cloudflare.com), reconciling Pablo's belief that DNS lived in Namecheap. I swept every expected subdomain (the Gateway, staging-api, docs missing; www, api present) and parsed the exported Cloudflare zone to enumerate exactly what migrated: apex/www/api/app plus full email (MX Google, SES/Resend DKIM, SPF, DMARC). I confirmed the conversion API both resolves and works (live 202/delivered), so blast radius was contained to three unshipped/unused subdomains, and produced the exact Cloudflare record to restore the Gateway, a proxied CNAME to its Netlify site mirroring the working app record, with a DNS-only SSL fallback.
Proved with NS records and a zone export that a Cloudflare migration silently dropped three subdomains, while production conversions and email kept running.
Role: Sole diagnostician; record edits to be done by whoever holds Cloudflare access
The Problem
The gateway admin UI ([internal-host]) became unreachable ('This site can't be reached / DNS_PROBE_FINISHED_NXDOMAIN'), blocking operators from the console.
[internal-host] did not resolve globally (NXDOMAIN even against [ip]). The domain's DNS had been migrated to Cloudflare nameservers (jule.ns / simon.ns.cloudflare.com), but three subdomains were never carried into the new zone.
The symptom looked like an app outage; Pablo believed DNS was in Namecheap; and the actual issue (registrar vs authoritative DNS manager) required distinguishing where records live from where the domain is registered.
Approach & Architecture
Resolved gateway/api/apex against [ip] and confirmed the Gateway=NXDOMAIN while api/apex resolve to Cloudflare proxy IPs (104.21.x/172.67.x). Checked NS records (Cloudflare) to prove the domain is registered at Namecheap but DNS is managed in Cloudflare. Swept all expected subdomains and read the exported zone file to enumerate exactly what is present vs missing, and confirmed email (MX/SPF/DKIM/DMARC) and the API/reporting/marketing sites are intact.
Registrar Namecheap → nameservers delegated to Cloudflare (jule/simon.ns.cloudflare.com) → Cloudflare zone holds all records (proxied). the Gateway is a Netlify site; the missing the Gateway record should CNAME to its .netlify.app, mirroring the existing [internal-host] → summit-chase-platform.netlify.app.
Key Decisions & Trade-offs
Hardest Part
Correcting the Namecheap-vs-Cloudflare mental model with evidence, proving via NS records that authoritative DNS is Cloudflare even though the domain is registered at Namecheap.
Technical Detail
BIND zone export ([internal-host]): A/CNAME/MX/TXT records
Cloudflare authoritative DNS (proxied), Namecheap registrar, Netlify (the Gateway + reporting), Squarespace (marketing), Amazon SES/Resend + Google Workspace (email)
Global resolution checks against [ip]; cross-checked the exported zone; verified api resolves AND functions (live test events returned 202/delivered)
Code
for h in the Gateway staging-api docs www api; do nslookup "$[internal-host]" [ip]; done nslookup -type=ns [internal-host] [ip] # jule.ns / simon.ns.cloudflare.com
[internal-host] CNAME <gateway-site>.netlify.app ; proxied (like [internal-host])
Diagnosed entirely from the workspace bash sandbox using dig/nslookup for DNS (respecting web-content-fetch restrictions), then parsed the user-provided Cloudflare zone export to enumerate present vs missing records and produce an exact, copy-ready fix.
Measured Results
Pinpointed that the Namecheap→Cloudflare migration carried apex/www/api/app/email but omitted gateway/staging-api/docs, and confirmed production conversions and email were unaffected. Delivered exact Cloudflare records to restore the Gateway (only the Gateway is needed); application-layer verification showed [internal-host] both resolves and works.
| Metric | Value | Before | Source |
|---|---|---|---|
| Subdomains dropped by the Cloudflare migration | 3 (the Gateway, staging-api, docs) | n/a | Global DNS resolution + zone export |
Every figure above was recorded during the work itself. Where no number was measured, none is claimed.