Placement order
Verify the domain without mixing identity systems.
Two different OpenAI products use TXT records. Do them in this order. Do not paste a Builder Profile challenge into the Admin Console, or the reverse.
- Leave apex and notebook alone.
@is Tailscale.notebookis an existing tunnel. - Pages on www only. Custom domain
www.wizard-fortress.com. Cloudflare creates the proxied CNAME. - Builder Profile. Verify
www.wizard-fortress.comonly. TXT namewww, DNS only. - Skip tenant SSO on this zone unless you really want work-email identity sharing a zone with Tailscale.
- Do not touch mail records. SPF is already
-all. Empty DKIM stays empty.
TXT placement
| Purpose | Name | Type | Proxy |
|---|---|---|---|
| Pages public gate | www | CNAME to Pages | Proxied |
| OpenAI Builder challenge | www | TXT | DNS only |
| Tailscale apex | @ | CNAME to ts.net | DNS only — do not edit |
| Notebook tunnel | notebook | CNAME to cfargotunnel | Proxied — do not edit |
Parent domain does not verify subdomains. Verify www as www.
Snapshot already in
2026-09-25 phone grid: 5 records. www is the empty slot. That is the gate.