The prelander domain pool, DNS onboarding, and the TLS mode the device checker needs.
The Mask runs at the edge, and the edge serves your prelanders from a pool of domains you own. Adding a few domains and rotating across them keeps any single one from burning — a blocked domain is skipped while the rest keep serving.
A freshly added domain is pending and serves no traffic until its DNS points at your instance. d0pe verifies this either by resolving the A-record to your platform IP, or — behind a proxy like Cloudflare — by confirming the domain serves an internal token at a well-known path. Only once verified does a domain flip to active and enter the serving pool. The result is cached, so nothing resolves DNS per click.
Each domain has a TLS mode. Normal sits behind Cloudflare's orange cloud — full cloak, but the TLS handshake is terminated by Cloudflare, so there's no JA4 device signal. Advanced runs grey-cloud with TLS terminated by the ja4-edge, which captures the visitor's JA4/JA4H fingerprint and injects it for scoring.
This is why the device/TLS layer of the Mask needs at least one Advanced domain that passes its readiness self-check: without it, there's no TLS fingerprint to score. A health worker keeps the pool honest, flagging unreachable or blocked domains and tracking each domain's geo reputation.