diff --git a/README.md b/README.md
index aade607..f0540a1 100644
--- a/README.md
+++ b/README.md
@@ -23,6 +23,19 @@ Requires Node 20.17+. The site is intended to publish at
 step in the Mintlify dashboard. Connect `CortexLM/docs`, branch `main`, with
 the content directory set to the repository root (not `apps/docs`).
 
+### Custom-domain DNS
+
+Every Cortex custom domain that CNAMEs to a third-party hostname is a
+**Direct CNAME (DNS only)** — `docs.cortex.foundation` (Mintlify),
+`status.cortex.foundation` (status page), the FernDesk **Connect domain**, and
+the `software.cortex.foundation` / `releases.cortex.foundation` R2 custom
+domains owned by
+[`CortexLM/backend`](https://github.com/CortexLM/backend)
+(`docs/software-cdn.md`).
+
+> **Use a Direct CNAME (DNS only). Do not enable orange-cloud Proxied** — that
+> causes Cloudflare **Cross-User Banned** (Error 1014).
+
 ## Checks
 
 ```bash
diff --git a/scripts/FERNDESK.md b/scripts/FERNDESK.md
index a6edad6..09ce17a 100644
--- a/scripts/FERNDESK.md
+++ b/scripts/FERNDESK.md
@@ -84,3 +84,8 @@ backoff). Local runs fall back to urllib only if `curl_cffi` is not installed.
 
 Separately: the FernDesk UI still needs **Connect domain** for `docs.cortex.foundation`
 HTTPS. That custom-domain 403 is unrelated to CF 1010 on `api.ferndesk.com`.
+
+When that record goes in, use a **Direct CNAME (DNS only)** — **do not enable
+orange-cloud Proxied**; that causes Cloudflare **Cross-User Banned** (Error 1014).
+The same rule holds for every other Cortex custom domain that CNAMEs to a
+third-party host: [`README.md`](../README.md#custom-domain-dns).