Round 2 — DNS Remediation Checklist

Date: 2026-07-29
Status: Action required — manual Cloudflare DNS records needed

---

Current DNS State

Domain	Resolves	IP	Cloudflare	Status
integratewise.ai	✅	104.21.25.123, 172.67.134.57	Proxied	Live
auth.integratewise.ai	✅	104.21.25.123, 172.67.134.57	Proxied	Live
gateway.integratewise.ai	❌	—	—	Missing
api.integratewise.ai	❌	—	—	Missing
workbench.integratewise.ai	❌	—	—	Missing
marketplace.integratewise.ai	❌	—	—	Missing
status.integratewise.ai	❌	—	—	Missing

---

Required Actions (Cloudflare Dashboard)

Step 1: Create DNS records

For each missing subdomain, add a CNAME or A record in Cloudflare DNS:

Domain	Type	Target	Proxy	Notes
gateway.integratewise.ai	CNAME	integratewise-prod.<account>.workers.dev	Proxied	Gateway Worker
api.integratewise.ai	CNAME	integratewise-prod.<account>.workers.dev	Proxied	Same Gateway Worker (path-based routing)
workbench.integratewise.ai	CNAME	integratewise-web.pages.dev or custom	Proxied	Next.js frontend
marketplace.integratewise.ai	CNAME	integratewise-web.pages.dev or custom	Proxied	Same frontend (path-based)
status.integratewise.ai	CNAME	integratewise-status.pages.dev or status page service	Proxied	Uptime/status page

Step 2: Create Cloudflare Workers routes

After DNS records propagate, create Worker routes in Cloudflare Dashboard:

gateway.integratewise.ai/api/* → integratewise-prod
gateway.integratewise.ai/v1/*  → integratewise-prod
api.integratewise.ai/*         → integratewise-prod

Step 3: Configure Cloudflare Pages

For workbench.integratewise.ai and marketplace.integratewise.ai:

1. Connect apps/web repo to Cloudflare Pages
2. Set build command: pnpm --filter @integratewise/web build
3. Set output directory: .next
4. Add custom domains in Pages settings

Step 4: Configure status page

For status.integratewise.ai:

• Option A: Use Cloudflare Status Page (if available on plan)
• Option B: Deploy a static status page to Pages
• Option C: Use external status service (Instatus, Betterstack, etc.)

Step 5: SSL/TLS settings

In Cloudflare Dashboard for each domain:

• SSL/TLS mode: Full (strict)
• Always Use HTTPS: On
• Minimum TLS version: 1.2
• HSTS: Enable (after confirming all subdomains resolve)

Step 6: Verify propagation

# After creating records, verify:
for d in gateway api workbench marketplace status; do
  echo -n "$d.integratewise.ai → "
  dig +short "$d.integratewise.ai" A | head -1
done

Expected: all resolve to Cloudflare IPs (104.21.x.x / 172.67.x.x)

---

Customer Zero Specific DNS

For Customer Zero isolation, consider:

Domain	Purpose	Required
customer-zero.integratewise.ai	Dedicated Customer Zero host	Optional — can use header-based routing instead
gateway.integratewise.ai	Shared Gateway	✅ Required

Recommendation: Use header-based tenant routing (x-tenant-id: iw-customer-zero) rather than a dedicated domain. Simpler DNS, same isolation via Gateway auth.

---

Verification After DNS Is Live

Once all DNS records are created and propagated:

1. curl -I https://gateway.integratewise.ai/health → should return 200
2. curl -I https://api.integratewise.ai/health → should return 200
3. curl -I https://workbench.integratewise.ai → should return 200
4. curl -I https://auth.integratewise.ai/.well-known/oauth-authorization-server → should return Clerk metadata
5. Verify Clerk JWKS endpoint: curl https://auth.integratewise.ai/clerk/.well-known/jwks.json

---

Blocking Status

Item	Blocks
DNS records	All deployment, Customer Zero activation, external product activation
Clerk production keys	Auth node, Gateway auth middleware, MCP Connector auth
Cloudflare Pages	Frontend deployment
Worker routes	Gateway API routing

None of these block code development. They block deployment and live verification only.