The prelander domain pool, DNS onboarding, and the TLS mode the device checker needs.
The Mask runs at the edge, and the edge serves your prelanders from a pool of domains you own. Adding a few domains and rotating across them keeps any single one from burning — a blocked domain is skipped while the rest keep serving.
A freshly added domain is pending and serves no traffic until its DNS points at your instance. d0pe verifies this either by resolving the A-record to your platform IP, or — behind a proxy like Cloudflare — by confirming the domain serves an internal token at a well-known path. Only once verified does a domain flip to active and enter the serving pool. The result is cached, so nothing resolves DNS per click.
Each domain has a TLS mode. Normal sits behind Cloudflare's orange cloud — full cloak, but the TLS handshake is terminated by Cloudflare, so there's no JA4 device signal. Advanced runs grey-cloud with TLS terminated by the ja4-edge, which captures the visitor's JA4/JA4H fingerprint and injects it for scoring.
This is why the device/TLS layer of the Mask needs at least one Advanced domain that passes its readiness self-check: without it, there's no TLS fingerprint to score. A health worker keeps the pool honest, flagging unreachable or blocked domains and tracking each domain's geo reputation.
Delivery does not need a domain. Leads are still validated, routed and sent to your partners with nothing linked — the warning on the Flows screen does not mean the system is idle.
What a domain buys you is the prelander: the short “Loading…” hop on your own domain where the visitor's device is fingerprinted and scored, the referrer and click are captured, and the player is cloaked on the way through. The device layer of the Mask lives here — it is the only place it can run, because it needs a real browser (external IP and phone providers score by API and don't need the hop). Skip it and there is no prelander: the lead goes straight to the partner link and the device layer and on-page parsing never run — you are delivering unprotected on the device axis. If you deliberately want pure S2S delivery, switch on “deliver without a Mask domain” to lift the go-live guard.