# Web Portals & Email

Domain portfolio, email infrastructure, DNS management — MC #100609 gap analysis and ops execution

# Gap Analysis & 2026-05-14 Ops

# Web Portals & Email — Gap Analysis & 2026-05-14 Ops

**Source:** MC #100609 (parent audit) + verifier-confirmed evidence + CEO decisions log 2026-05-14  
**Ops execution:** MC #100619 (DONE, 5/5 PASS), MC #100618 (PARTIAL — ops 2-3 BLOCKED)

---

## Executive Summary

ALAI controls **15 registered domains** across product lines (Bilko, SnowIT, Drop, Tok), spanning Serbia, Croatia, Bosnia, Norway, and global markets. Audit MC #100609 identified:

- **Cloudflare Access login walls** blocking public www.alai.no + www.basicconsulting.no (FIXED 2026-05-14)
- **Split-brain email risk:** 5 domains retained stale one.com MX fallback records after Migadu migration (FIXED 2026-05-14)
- **Missing DMARC quarantine protection** on 5 production email domains (FIXED 2026-05-14)
- **3 orphaned domains** requiring cleanup or sunset (1 DONE, 2 BLOCKED on external DNS creds)

**Post-ops status (2026-05-14):** 8/8 domains on Migadu Standard plan (verified); 6/8 DMARC p=quarantine active; CF Access removed from www subdomains; one.com MX cleaned up on all domains. Two external partner domains (merdzanovic.ba, freemyev.com) blocked pending DNS provider access.

---

## Domain Inventory — LIVE / PLACEHOLDER / BROKEN / MISSING

### Production Domains (8 active email + web)

<table id="bkmrk-domain-status-primar"><thead><tr><th>Domain</th><th>Status</th><th>Primary Use</th><th>CF Zone</th><th>Migadu Email</th><th>DMARC</th></tr></thead><tbody><tr><td>alai.no</td><td>LIVE</td><td>Holding company, system infra (docs/vault/mc/boards)</td><td>YES</td><td>YES</td><td>p=quarantine</td></tr><tr><td>basicconsulting.no</td><td>LIVE</td><td>Historical brand domain (ALAI Holding AS legal name was Basic AS until 2026-05-07)</td><td>YES</td><td>YES</td><td>p=quarantine</td></tr><tr><td>basicfakta.no</td><td>LIVE</td><td>Historical client portal (parked)</td><td>TBD</td><td>YES</td><td>p=quarantine</td></tr><tr><td>bilko.io</td><td>LIVE</td><td>Bilko Serbia market (canonical)</td><td>YES</td><td>YES</td><td>p=quarantine</td></tr><tr><td>bilko.cloud</td><td>LIVE</td><td>Bilko Croatia market (canonical, NOT bilko.hr)</td><td>TBD</td><td>YES (added 2026-05-14)</td><td>TBD</td></tr><tr><td>bilko.company</td><td>LIVE</td><td>Bilko Bosnia market (canonical, NOT bilko.ba)</td><td>TBD</td><td>YES (added 2026-05-14)</td><td>TBD</td></tr><tr><td>snowit.ba</td><td>LIVE</td><td>SnowIT SMB market</td><td>YES</td><td>YES</td><td>p=quarantine (pre-existing)</td></tr><tr><td>enterprise.snowit.ba</td><td>LIVE</td><td>SnowIT Enterprise brand split (Vercel CNAME only, no email)</td><td>NO (CNAME)</td><td>NO</td><td>n/a</td></tr><tr><td>getdrop.no</td><td>LIVE</td><td>Drop fintech (canonical, NOT drop.no which is TV2 Norway)</td><td>TBD</td><td>YES</td><td>p=quarantine</td></tr><tr><td>tokapi.io</td><td>LIVE</td><td>Tok API infrastructure</td><td>YES</td><td>TBD</td><td>TBD</td></tr></tbody></table>

### Partner / Legacy Domains (cleanup pending)

<table id="bkmrk-domain-status-owner-"><thead><tr><th>Domain</th><th>Status</th><th>Owner</th><th>Action</th></tr></thead><tbody><tr><td>merdzanovic.ba</td><td>BROKEN (404)</td><td>Enis Merdžanović (SnowIT partner, globaldns.com)</td><td>BLOCKED — awaiting DNS access (MC #100618 op2)</td></tr><tr><td>freemyev.com</td><td>PLACEHOLDER (405)</td><td>ALAI (GoDaddy, creds unknown)</td><td>BLOCKED — NULL-MX sunset pending (MC #100618 op3)</td></tr><tr><td>vivacareusa.com/.net/.org</td><td>DELETED</td><td>ALAI (superseded by LumisCare)</td><td>DONE — file tree deleted 2026-05-14 (MC #100618 op1)</td></tr></tbody></table>

---

## Bilko Market Domain Mapping (CEO 2026-05-14 Clarification)

CEO confirmed canonical domains per market. Do NOT pursue bilko.hr (unrelated Croatian firm, expires 2026-12-14). Do NOT pursue bilko.rs/.ba/.no (unregistered; deferred decision on brand protection).

<table id="bkmrk-market-canonical-dom"><thead><tr><th>Market</th><th>Canonical Domain</th><th>Owned</th><th>Notes</th></tr></thead><tbody><tr><td>Serbia</td><td>bilko.io</td><td>YES</td><td>NOT bilko.rs (unregistered, MC #100124)</td></tr><tr><td>Croatia (HR)</td><td>bilko.cloud</td><td>YES</td><td>NOT bilko.hr (BILKO d.o.o. Zagreb, unrelated firm, expires 2026-12-14)</td></tr><tr><td>Bosnia (BiH)</td><td>bilko.company</td><td>YES</td><td>NOT bilko.ba (unregistered)</td></tr><tr><td>Norway</td><td>none</td><td>NO</td><td>bilko.no unregistered (brand protection gap, deferred decision)</td></tr></tbody></table>

---

## Email Infrastructure (Migadu)

### Configuration

- **Provider:** Migadu (https://admin.migadu.com)
- **Credentials:** Bitwarden — search "migadu"
- **Plan:** Standard (unlimited domains, verified by Proveo MC #100619)
- **Active domains:** 8 (alai.no, basicconsulting.no, basicfakta.no, bilko.io, snowit.ba, getdrop.no, bilko.cloud, bilko.company)
- **MX format:** 10 aspmx1.migadu.com / 20 aspmx2.migadu.com

### 2026-05-14 Cleanup — Stale one.com MX Removal

MC #100619 op2 removed 5 legacy one.com MX records (split-brain risk — if Migadu failed, mail would silently reroute to dead one.com inbox).

<table id="bkmrk-domain-removed-recor"><thead><tr><th>Domain</th><th>Removed Records</th><th>Verification</th></tr></thead><tbody><tr><td>alai.no</td><td>100 c74jebhf4.mx.service.one.</td><td>PASS — dig +short MX alai.no returns only Migadu (2 records)</td></tr><tr><td>basicconsulting.no</td><td>4× 100 mx\[1-4\].pub.mailpod11-cph3.one.com.</td><td>PASS — dig +short MX basicconsulting.no returns only Migadu (2 records)</td></tr></tbody></table>

### DMARC Policy Upgrade — p=quarantine

MC #100619 op4 upgraded 5 domains from p=none to p=quarantine pct=100 (reject suspicious mail at DMARC layer, not just SPF/DKIM).

<table id="bkmrk-domain-before-after-"><thead><tr><th>Domain</th><th>Before</th><th>After</th><th>Verification</th></tr></thead><tbody><tr><td>alai.no</td><td>p=none</td><td>p=quarantine</td><td>PASS — dig +short TXT \_dmarc.alai.no returns v=DMARC1; p=quarantine; pct=100</td></tr><tr><td>basicconsulting.no</td><td>p=none</td><td>p=quarantine</td><td>PASS</td></tr><tr><td>basicfakta.no</td><td>p=none</td><td>p=quarantine</td><td>PASS</td></tr><tr><td>bilko.io</td><td>p=none</td><td>p=quarantine</td><td>PASS</td></tr><tr><td>getdrop.no</td><td>p=none</td><td>p=quarantine</td><td>PASS</td></tr><tr><td>snowit.ba</td><td>p=quarantine</td><td>(no change)</td><td>n/a — already compliant</td></tr><tr><td>bilko.cloud</td><td>TBD</td><td>TBD</td><td>Pending — added to Migadu 2026-05-14, DMARC not yet configured</td></tr><tr><td>bilko.company</td><td>TBD</td><td>TBD</td><td>Pending — added to Migadu 2026-05-14, DMARC not yet configured</td></tr></tbody></table>

---

## Cloudflare Access Status (post 2026-05-14)

### Issue (MC #100609 Claim A — CONFIRMED HIGH by verifier)

www.alai.no and www.basicconsulting.no returned HTTP 302 redirect to cloudflareaccess.com login wall instead of landing pages. Public visitors saw auth gate.

### Fix (MC #100619 op1)

Applied CF Access bypass policies to both www apps. Post-fix curl verification:

- **www.alai.no:** HTTP/2 522 (origin connection timeout — no 302 to cloudflareaccess.com)
- **www.basicconsulting.no:** HTTP/2 404 (Vercel DEPLOYMENT\_NOT\_FOUND — no 302 to cloudflareaccess.com)

**Acceptance criterion:** PASS — neither domain returns 302 to cloudflareaccess.com. 522/404 are origin configuration errors (separate issue, MC opened for redirect/origin path decision).

### Known Issue (post-fix)

www subdomain origins return 522 (alai.no) or 404 (basicconsulting.no) instead of canonical redirect to apex or landing page. Separate MC opened; root cause = missing origin configuration in CF Pages or manual redirect rule needed.

---

## Park / Sunset Decisions (CEO 2026-05-14)

<table id="bkmrk-domain-decision-stat"><thead><tr><th>Domain</th><th>Decision</th><th>Status</th><th>Notes</th></tr></thead><tbody><tr><td>alaione.no (Lobby product)</td><td>PARK</td><td>NXDOMAIN — no action needed</td><td>Product inactive, never re-registered after expiry</td></tr><tr><td>fontelepay.com (Lobby)</td><td>PARK</td><td>NXDOMAIN — no action needed</td><td>Product inactive</td></tr><tr><td>rendrom.no (legacy)</td><td>PARK</td><td>NXDOMAIN — no action needed</td><td>Unknown origin, never registered by ALAI</td></tr><tr><td>gotiva.\* (placeholder)</td><td>PARK</td><td>NXDOMAIN — no action needed</td><td>Name collision with gotiva.ba (video studio, unrelated)</td></tr><tr><td>freemyev.com</td><td>NULL-MX SUNSET</td><td>BLOCKED — GoDaddy creds needed</td><td>RFC 7505 NULL MX (0 .) + DMARC p=reject + SPF v=spf1 -all. Current: HTTP 405, AWS backend. MC #100618 op3 documented DNS changes.</td></tr><tr><td>vivacareusa (.com/.net/.org)</td><td>DELETE</td><td>DONE — MC #100618 op1</td><td>File tree deleted ~/clients-external/vivacareusa/ (backup ~/backups/vivacareusa-final-20260514.tar.gz). Domain ownership TBD.</td></tr><tr><td>merdzanovic.ba</td><td>RECONNECT CF Pages</td><td>BLOCKED — Enis DNS access</td><td>Partner domain (Enis Merdžanović, SnowIT). CF Pages project live (51deeb8e.merdzanovic-ba.pages.dev HTTP 200), custom domain failed DNS verification. Current DNS = Vercel (404 DEPLOYMENT\_NOT\_FOUND). MC #100618 op2 documented DNS changes for globaldns.com.</td></tr></tbody></table>

---

## Squat Watchlist (defer purchase, monitor expiry)

<table id="bkmrk-domain-current-owner"><thead><tr><th>Domain</th><th>Current Owner</th><th>Expires</th><th>Decision</th></tr></thead><tbody><tr><td>plock.se</td><td>NEware AB (fruits.co marketplace, EUR 16k asking price)</td><td>2026-12-06</td><td>Defer — monitor for drop, not worth EUR 16k floor</td></tr><tr><td>bilko.hr</td><td>BILKO d.o.o. Zagreb (Ulica Grada Vukovara 246, legitimate Croatian firm)</td><td>2026-12-14</td><td>Do NOT pursue — unrelated business, bilko.cloud is canonical for HR market</td></tr><tr><td>drop.no</td><td>TV2 Norway (major broadcaster)</td><td>n/a</td><td>Not ALAI — we use getdrop.no</td></tr><tr><td>drop.app</td><td>Google (Charleston Road Registry, .app TLD operator)</td><td>n/a</td><td>Unobtainable — .app TLD controlled by Google</td></tr><tr><td>tok.no</td><td>transportbransjen.no (NEware AB)</td><td>2026-12-06</td><td>Cannot acquire imminently — we use tokapi.io</td></tr></tbody></table>

---

## Pending CEO Action

1. **Enis Merdžanović coordination (merdzanovic.ba):** Provide globaldns.com panel access OR approve CF DNS transfer. Instructions documented in MC #100618 op2 evidence (~/system/evidence/100618-op2-dns-instructions.txt).
2. **GoDaddy credentials (freemyev.com):** Locate account access OR approve CF domain transfer. Instructions documented in MC #100618 op3 evidence (~/system/evidence/100618-op3-dns-instructions.txt).
3. **www.alai.no + www.basicconsulting.no origin path decision:** Separate MC opened (FlowForge queue). Options: (a) 301 redirect www → apex, (b) deploy static landing page to www origin, (c) configure CF Pages www custom domain.

---

## Evidence References

- **Audit source:** MC #100609 verifier transcript (atomic claims 6/7 HIGH confidence) — /private/tmp/claude-501/-Users-makinja/79c227d4-489c-48ca-9d81-4e3ac42922ff/tasks/a5326fb78f47469ec.output
- **Ops execution:** MC #100619 Proveo validation 5/5 PASS — ~/system/evidence/100619-proveo-validation.txt + ~/system/evidence/100619-op\[1-5\]-\*.txt
- **Ops partial:** MC #100618 FlowForge report — ~/system/evidence/100618-flowforge-report.md + ~/system/evidence/100618-op1-\*.txt + ~/system/evidence/100618-op2-\*.txt + ~/system/evidence/100618-op3-\*.txt
- **System-level infra map:** ~/aisystem/DEPLOY-MAP.md sections 1-8 (Email &amp; DNS extensions added 2026-05-14)

---

*Published: 2026-05-14 | MC: #100613 | Author: Skillforge (John orchestrator)*