diff --git a/dns/beatrax.app.zone b/dns/beatrax.app.zone
deleted file mode 100644
index 53720df..0000000
--- a/dns/beatrax.app.zone
+++ /dev/null
@@ -1,56 +0,0 @@
-; beatrax.app — Cloudflare DNS zone
-;
-; Import: Cloudflare dashboard → beatrax.app → DNS → Records
-;         → Import and Export → Import DNS records → upload this file.
-;
-; Set every A, AAAA and CNAME record below to DNS only (grey cloud) until
-; GitHub has issued the certificate for beatrax.app. Proxying before then
-; hides the origin from GitHub's validation and the certificate never issues.
-; Once "Enforce HTTPS" is available under the repository's Pages settings,
-; proxying can be turned on if you want Cloudflare in front of it.
-;
-; .app is on the HSTS preload list, so browsers refuse plain HTTP for this
-; domain by policy. That is the intended behaviour and needs no record.
-
-$ORIGIN beatrax.app.
-$TTL 3600
-
-; ── Apex → GitHub Pages ───────────────────────────────────────────────
-; The four published Pages anycast addresses. All four belong here; GitHub
-; balances across them, so dropping one costs availability for no gain.
-@       3600  IN  A       185.199.108.153
-@       3600  IN  A       185.199.109.153
-@       3600  IN  A       185.199.110.153
-@       3600  IN  A       185.199.111.153
-@       3600  IN  AAAA    2606:50c0:8000::153
-@       3600  IN  AAAA    2606:50c0:8001::153
-@       3600  IN  AAAA    2606:50c0:8002::153
-@       3600  IN  AAAA    2606:50c0:8003::153
-
-; ── www → the same site ───────────────────────────────────────────────
-; GitHub redirects www to the apex on its own, because the repository's
-; CNAME file names the apex. No redirect rule is needed here.
-www     3600  IN  CNAME   beatrax-app.github.io.
-
-; ── GitHub organisation verification ──────────────────────────────────
-; Proves beatrax-app owns this domain. That is what lets Pages sites in the
-; organisation serve it, and what stops anyone else from claiming it.
-_github-challenge-beatrax-app-org  3600  IN  TXT  "0b5a763863f5ae4b2231a4dc9d2549"
-
-; ── Certificate authority authorisation ───────────────────────────────
-; Pages certificates come from Let's Encrypt. digicert and pki.goog are the
-; authorities Cloudflare issues its own edge certificates from, so they stay
-; authorised in case these records are proxied later.
-@       3600  IN  CAA     0 issue "letsencrypt.org"
-@       3600  IN  CAA     0 issue "digicert.com"
-@       3600  IN  CAA     0 issue "pki.goog"
-@       3600  IN  CAA     0 issuewild ";"
-
-; ── Mail: this domain sends none ──────────────────────────────────────
-; A domain with no mail policy is a free spoofing target. These say, in the
-; three places a receiver looks, that nothing legitimate is ever sent from
-; beatrax.app.
-@       3600  IN  MX      0 .
-@       3600  IN  TXT     "v=spf1 -all"
-_dmarc  3600  IN  TXT     "v=DMARC1; p=reject; rua=mailto:info@nightworks.io; aspf=s; adkim=s"
-*._domainkey  3600  IN  TXT  "v=DKIM1; p="