Measured 2026-11-04: the router's 80/443 forward plus Caddy's vhost list are the
only gates — a public A record buys discoverability, not access — so internal-
only means an absent record. Publishes the outstanding fact: the whole
authentik-guarded set now carries a record; the exempt self-authenticating names
and the legacy redirects do not. Adds the dynamic-WAN caveat and the 1800 s
negative-cache trap that makes a fresh record look broken.
Frank
6c169fc4ad