// INFRASTRUCTURE_MANIFEST

Deployment Roadmap & Architecture Audit

Current state of live DNS propagation, Supabase SQL schema readiness, and hosting targets.

Authoritative DNS & Resend Verification

PROPAGATED_AND_RESOLVED

DKIM PUBLIC KEY (TXT)

resend._domainkey.subdomainwatch.com

Status: 2048-bit RSA Active on ui-dns nameservers

RETURN-PATH ROUTING (MX)

send.subdomainwatch.com → feedback-smtp.eu-west-1.amazonses.com

Status: Priority 10 Active (Amazon SES Mail Transfer)

ENVELOPE SENDER SPF (TXT)

v=spf1 include:amazonses.com ~all

Status: Strict SPF mechanism authorized

DMARC POLICY (TXT)

v=DMARC1; p=none; rua=mailto:security@subdomainwatch.com

Status: Daily aggregate reporting active to security mailbox

1. Execute Supabase Schema Migrations

PENDING_EXECUTION

The Supabase database currently lacks the 12 core tables and Row Level Security policies. The SQL files are ready in the repo:

migrations/001_initial_schema.sql (Tables, RLS, Indexes)

migrations/002_ingest_scan_run_rpc.sql (Atomic ingest_scan_run stored procedure)

2. Select Production Web Hosting Target

READY_TO_DEPLOY

Option A: Vercel (Recommended)

Zero-config Next.js 16 deployment with automatic preview URLs and global edge caching.

Option B: Cloudflare Pages / Workers

Pairs with Cloudflare DNS proxying and edge routing.

3. Automated Scanner Execution Runner

ARCHITECTURE_PLANNED

The Python reconnaissance engine (scanner.py + ingest.py) runs on:

• GitHub Actions Cron: 100% serverless, zero idle server cost, executes hourly/daily.

• Lightweight Container Worker (Fly.io / AWS ECS): Enables instant, customer-triggered on-demand scan runs.