Phase 4 — Cloudflare records to add for staging

Status: pending Taha action, 2026-04-21. Purpose: delegate the stage.askflorence.health subzone from Cloudflare to Route 53 in the staging AWS account. All engineering DNS (ACM, SES, future ALB + CloudFront aliases) auto-managed by Terraform in Route 53.

Architecture

• Apex askflorence.health stays on Cloudflare permanently. Holds G Suite MX records, Google Search Console + other verification TXT records, marketing redirects, and (at Phase 10 cutover) a CNAME to the prod CloudFront distribution.
• stage.askflorence.health subzone is delegated to Route 53 in the staging AWS account (549136075525). Terraform manages every record inside it.
• Future prod pattern (Phase 8): prod.askflorence.health → Route 53 in prod account. Apex stays on Cloudflare with a CNAME-flattened record pointing to CloudFront for the consumer-facing app.

Action: add 4 NS records at Cloudflare

Add the following as NS records on askflorence.health at Cloudflare. DNS-only (no proxy / gray cloud).

Type	Name	Value	TTL	Proxy
NS	stage	ns-1115.awsdns-11.org	Auto	OFF
NS	stage	ns-1945.awsdns-51.co.uk	Auto	OFF
NS	stage	ns-410.awsdns-51.com	Auto	OFF
NS	stage	ns-973.awsdns-57.net	Auto	OFF

Cloudflare represents this as four rows with the same name stage and type NS, each pointing to one of the AWS nameservers. After adding, recursive resolvers world-wide will route all *.stage.askflorence.health queries to Route 53.

What happens after the NS records are live (~1-5 min propagation)

Terraform already created everything else in Route 53:

• 1 CNAME for ACM cert validation
• 3 CNAMEs for SES DKIM tokens
• 1 MX for SES MAIL FROM feedback routing
• 1 TXT (SPF) on MAIL FROM subdomain
• 1 TXT (DMARC) on the subzone

Once delegation is live:

• ACM: validates the cert for stage.askflorence.health + *.stage.askflorence.health. Transitions from PENDING_VALIDATION to ISSUED typically within 5 min. Terraform's aws_acm_certificate_validation resource will complete.
• SES: verifies the stage.askflorence.health identity (checks DKIM CNAMEs). Transitions from PENDING to SUCCESS typically within 5-30 min. SES is sandboxed by default — you'll need to request production access (out of sandbox) before real emails can go to arbitrary recipients, but identity verification is the prerequisite.

Verification

From any machine:

# Confirm NS delegation is live
dig +short NS stage.askflorence.health
# Expect: 4 ns-* AWS nameservers

# Confirm ACM cert status
aws --profile askflorence-staging acm describe-certificate \
  --certificate-arn arn:aws:acm:us-east-1:549136075525:certificate/3023432f-d564-4a3c-8db5-e4a7423c9c2f \
  --query 'Certificate.Status' --output text
# Expect: ISSUED (may be PENDING_VALIDATION for first ~5 min)

# Confirm SES identity
aws --profile askflorence-staging sesv2 get-email-identity \
  --email-identity stage.askflorence.health \
  --query '[VerifiedForSendingStatus,DkimAttributes.Status]' --output text
# Expect: True SUCCESS (first column may be False initially)

# Confirm all Route 53 records are queryable world-wide
dig +short CNAME _2ce2a5f6fea59d599db1cbf96e35df98.stage.askflorence.health
# Expect: _0c6d7ec5ae3a4885ddf1691b4cd9c22b.jkddzztszm.acm-validations.aws.

Phase 8 prod equivalent (future)

When Phase 8 ships the prod account mirror, the same pattern repeats:

• Create Route 53 hosted zone for prod.askflorence.health in prod AWS account (039624954211)
• Taha adds 4 NS records at Cloudflare for prod delegation
• Terraform manages all records in the prod subzone

Separately, at Phase 10 DNS cutover, Taha updates one Cloudflare record — the apex askflorence.health CNAME — from Vercel to the prod CloudFront distribution. Cloudflare's CNAME flattening makes the apex resolve directly to CloudFront.

Related

• Phase 4 Terraform: infra/envs/staging/dns.tf + consolidated acm.tf + ses.tf
• Modules with Route 53 integration: infra/modules/acm/ + infra/modules/ses/ (both accept manage_dns_in_route53 = true to auto-manage records)
• Change log: change-log.md
• Architecture plan: apex-on-Cloudflare, engineering-in-Route53 hybrid per 2026-04-21 decision