custom-domain: stop publishing an underscore-leading CNAME target

[h4x3rotab]

GATEWAY_DOMAIN is published as the custom domain's CNAME target, and the examples used _.<gateway-domain>. That name is unresolvable on Android.

Android's resolver runs every name in an A/AAAA answer through res_hnok, including the CNAME RDATA (getaddrinfo.cpp), and res_hnok accepts _ only between two alphanumerics:

#define borderchar(c) (alphachar(c) || digitchar(c))
#define middlechar(c) (borderchar(c) || hyphenchar(c) || underscorechar(c))

A label starting with _ sits in the border position, fails the check, and getanswer() drops the whole chain — so the hostname does not resolve on Android. glibc permits _ at any position and only rejects a leading -, which is why this never shows up in Linux or desktop-browser testing.

Note that _access would fail identically; the fix has to avoid a leading underscore, not just the bare _ label.

Change

Examples now use gateway.<gateway-domain>. The label is arbitrary: the gateway zone is a wildcard, the name never travels on the wire, and routing is driven by the client's SNI plus the app-address TXT record. Docs and default values only — no script logic changed, since dnsguide.py and dnsman.py already pass the value through verbatim.

_. keeps resolving, so this breaks no existing deployment — those are simply still broken on Android until they move.

Matching docs change: Phala-Network/phala-docs#177

🤖 Generated with Claude Code

[Leechael]

lgtm