# Custom domains DNS reference

> The exact DNS records for pointing a domain at your Vaulter app.

This page explains the DNS records involved in pointing a custom domain at your Vaulter app: what each one is, and why it exists. The exact values for your domain are generated in **Vault → Domains** when you add it, and that screen is always the authoritative source; every record there has a copy button.

## The three records

When you [connect a domain you own](/docs/publish/connect-domain), Vaulter asks for three records at your DNS provider:

### 1. The traffic record (CNAME)

A **CNAME** on your chosen host (for example `www`, or a subdomain like `app`) pointing at Vaulter's edge, `proxy-fallback.vaulter.run`. This is the record that actually routes visitors to your app. Vaulter's network receives the request, recognizes your domain, and serves your latest published deployment.

### 2. The certificate record (CNAME)

A second CNAME used for **SSL issuance**. It lets the certificate authority confirm, continuously, that your domain should have a certificate for Vaulter to serve, which is how your app gets and keeps HTTPS without you ever touching a certificate. Its name and value are unique to your domain; copy them exactly from the Domains panel.

### 3. The ownership record (TXT)

A **TXT** record proving you control the domain, so nobody else can claim your domain onto their app. It is checked when you connect and should stay in place.

## Root domains vs subdomains

- A **subdomain** like `app.example.com` connects directly with the records above.
- A **root domain** like `example.com` is served at `www.example.com`, because DNS does not reliably allow CNAME records at the root. Add your provider's redirect from the bare domain to `www` so both forms reach your app; nearly every provider has this as a built-in option.

## Domains bought in Vaulter

None of this page applies to a [domain bought inside Vaulter](/docs/publish/buy-a-domain): registration, all records, connection, and SSL are configured automatically, and Vaulter manages the DNS for you.

## When it will not verify

DNS changes take minutes to hours to propagate, and the Domains panel keeps checking on its own. If a domain is stuck well past a few hours, the cause is almost always one of these:

- A record's **name or value** does not exactly match what the panel shows: a stray character, a duplicated domain in the name field, or a trailing dot where there should not be one.
- An **old conflicting record** on the same name, such as a leftover A record on `www`, which wins over your new CNAME at some providers.
- A provider feature that **proxies or flattens** the record; the certificate CNAME must be published as-is.

Fix the record, and the panel will pick it up on its next check.