staging.strata9.cloud is delegated from Porkbun to Strata self-hosted DNS, served by the built-in gateway with an auto-issued Lets Encrypt cert. No Cloudflare, no glue records.