By the way, even while a custom domain is still pending verification, the GitHub Pages LB will route the request based on the Host header, allowing for the following:
dig +short github.io | head -1
185.199.108.153
curl -H "Host: 42.news.ycombinator.com" 185.199.109.153
hello
Don't point a wildcard domain to Github. It's a wildcard and dangerous.
Managing DNS through DigitalOcean (although, this should be possible with any DNS service) requires both pointing the nameservers to that service and adding the domain to your account. If you delete the domain from your account, like I had, but forget to update the nameservers with your registrar, anyone else can claim the domain. Theoretically, if you redirect the nameservers first and then add the domain to your account, someone could swipe it from you, I guess. Though it would basically have to be pure luck.
Why is it always slot machines though?
I would say probably 10 years, I remember reading about the CNAME github issue around 2015 or so, as before that most used to use jekyll with gh pages, was very popular among indie developers
edit: apparently CNAME can't be used for TLD+1, only for subdomains, so you have to use a more error prone approach for those.
I think this is the expected outcome.
It's good you noticed and shared your findings, but to me this "works as intended"
It's like saying "my motorbike was stolen" when you let the key in the ignition for a day in the favelas. What did you expect exactly?
It may be that the words you're writing don't seem so snarky when they're just being formulated in your mind; that's a common pitfall with online discussion forums. Please try to more thoughtful about how your words come across.
You didn't think through the consequences, and you could learn a bit more about DNS.
I did not expect that Github facilitates other accounts creating scam pages under the domain I own...