Custom domains DNS reference

This page explains the DNS records involved in pointing a custom domain at your Vaulter app: what each one is, and why it exists. The exact values for your domain are generated in Vault → Domains when you add it, and that screen is always the authoritative source; every record there has a copy button.

The three records

When you connect a domain you own, Vaulter asks for three records at your DNS provider:

1. The traffic record (CNAME)

A CNAME on your chosen host (for example www, or a subdomain like app) pointing at Vaulter's edge, proxy-fallback.vaulter.run. This is the record that actually routes visitors to your app. Vaulter's network receives the request, recognizes your domain, and serves your latest published deployment.

2. The certificate record (CNAME)

A second CNAME used for SSL issuance. It lets the certificate authority confirm, continuously, that your domain should have a certificate for Vaulter to serve, which is how your app gets and keeps HTTPS without you ever touching a certificate. Its name and value are unique to your domain; copy them exactly from the Domains panel.

3. The ownership record (TXT)

A TXT record proving you control the domain, so nobody else can claim your domain onto their app. It is checked when you connect and should stay in place.

Root domains vs subdomains

• A subdomain like app.example.com connects directly with the records above.
• A root domain like example.com is served at www.example.com, because DNS does not reliably allow CNAME records at the root. Add your provider's redirect from the bare domain to www so both forms reach your app; nearly every provider has this as a built-in option.

Domains bought in Vaulter

None of this page applies to a domain bought inside Vaulter: registration, all records, connection, and SSL are configured automatically, and Vaulter manages the DNS for you.

When it will not verify

DNS changes take minutes to hours to propagate, and the Domains panel keeps checking on its own. If a domain is stuck well past a few hours, the cause is almost always one of these:

• A record's name or value does not exactly match what the panel shows: a stray character, a duplicated domain in the name field, or a trailing dot where there should not be one.
• An old conflicting record on the same name, such as a leftover A record on www, which wins over your new CNAME at some providers.
• A provider feature that proxies or flattens the record; the certificate CNAME must be published as-is.

Fix the record, and the panel will pick it up on its next check.