Custom Domains

Every project gets a default URL at {slug}.sites.deploybase.eu. Custom domains let you serve your site from your own domain (e.g. blog.example.com).

There are two ways to connect a domain:

• Configure DNS yourself (default, recommended) — you add a CNAME (subdomain) or ALIAS/ANAME (root) plus a verification TXT record at your DNS provider. Described below.
• Managed DNS (beta) — deploybase hosts your DNS: you delegate your domain’s nameservers to us once, and everything else (root domain support, SSL) is automatic. See Managed DNS.

Setup Flow

1. Add the Domain

curl -X POST https://api.deploybase.eu/api/v1/domains \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"project_id": "PROJECT_ID", "domain": "blog.example.com"}'

The response includes a verification_token and a dns_records list with the exact records to add — including your domain’s unique CNAME target (it looks like deploybase-d-1a2b3c4d5e6f7a8b.b-cdn.net; every domain gets its own). The same records are shown in the dashboard after you add the domain.

2. Configure DNS Records

Add two DNS records at your domain registrar:

Type	Name	Value	Purpose
TXT	_deploybase-verify.blog.example.com	{verification_token}	Ownership verification
CNAME	blog.example.com	{your CNAME target}	Traffic routing

DNS propagation typically takes 5–30 minutes.

Subdomains (including www) only need a CNAME. www.example.com is a normal subdomain — point it at your CNAME target and it works like any other. Apex/root domains are the only special case (see Apex domains).

3. Verify Ownership

After DNS propagation, trigger verification:

curl -X POST https://api.deploybase.eu/api/v1/domains/DOMAIN_ID/verify \
  -H "Authorization: Bearer $TOKEN"

Rate limited to once per 60 seconds per domain.

4. SSL Provisioning

SSL certificates are provisioned automatically after successful verification. No manual steps required. Certificate status progresses: pending → issued.

Choosing apex or www as your canonical domain

You can run your site from either the apex (example.com) or www (www.example.com) — pick whichever you add as the domain. They behave differently at the DNS layer:

Apex canonical (example.com) — add example.com as the domain. Because the root of a zone can’t use a CNAME, you need an ALIAS/ANAME record (see Apex domains). www.example.com is not set up for you: apex and www are two separate domains here, as on Vercel and Netlify. If you want www to work too, add it as a second domain (a plain CNAME, see below), or let Managed DNS host the zone — there the apex and www are both wired up for you.

www canonical (www.example.com) — add www.example.com as the domain. A www CNAME works on every DNS provider, so this is the simplest option if your provider has no ALIAS/ANAME support:

Type	Name	Value
CNAME	www.example.com	{your CNAME target}
TXT	_deploybase-verify.www.example.com	{verification_token}

To send the root to your www site, add an apex redirect at your DNS provider (many offer a “redirect”/“web forwarding” record) pointing example.com → https://www.example.com. deploybase doesn’t need to manage the apex in this setup. Note that some providers’ redirect services only answer over HTTP — check DNS provider compatibility to see whether yours redirects https:// traffic correctly.

Domain Status

Check domain status at any time:

curl https://api.deploybase.eu/api/v1/domains/DOMAIN_ID \
  -H "Authorization: Bearer $TOKEN"

Status	Meaning
pending_verification	DNS TXT record not yet detected
awaiting_delegation	Managed DNS only: nameserver delegation not yet detected
verified	Domain verified, SSL provisioning in progress or complete

The response includes ssl_status (pending or issued) when the domain is verified.

Apex Domains

For apex/root domains (e.g. example.com without a subdomain), use an ALIAS or ANAME record (CNAME flattening) pointing to your CNAME target. Standard DNS does not allow CNAME records on the zone apex. Cloudflare, Route 53, TransIP, Netlify and many modern DNS hosts support ALIAS/ANAME records — see DNS provider compatibility for a verified list of Dutch and German providers.

Type	Name	Value
ALIAS / ANAME	example.com	{your CNAME target}

A records won’t work. Bunny’s CDN has no stable anycast IP, so there is no A-record value that works — and a stale A record blocks SSL issuance. Use ALIAS/ANAME, or, if your provider doesn’t support it, use www as your canonical domain instead (a CNAME works anywhere — see above), or let Managed DNS host the zone for you.

Managed DNS (beta)

If your DNS provider has no ALIAS/ANAME support — or you’d rather not manage records at all — deploybase can host your domain’s DNS. Instead of adding individual records, you delegate the domain’s nameservers to deploybase once at your registrar; we create and maintain everything inside the zone.

What you get:

• Root domains work at any registrar — the zone resolves the apex internally, no ALIAS/ANAME needed.
• Both apex and www are wired up automatically when the domain you add is the root (example.com) — no records to add or keep in sync. Adding a subdomain (blog.example.com) wires up that subdomain only.
• SSL is issued automatically, and there is no verification TXT record: delegation itself proves ownership.

To use it, select “We host your DNS” when adding the domain in the dashboard, or pass the connection mode via the API:

curl -X POST https://api.deploybase.eu/api/v1/domains \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"project_id": "PROJECT_ID", "domain": "example.com", "connection_mode": "managed_dns"}'

The response’s dns_records lists two NS records — the nameservers to set at your registrar (replacing the existing ones). The domain stays in awaiting_delegation until we detect the change, then SSL provisions automatically and the domain goes live.

Delegation detection and “Check now”

deploybase checks delegation about every 30 seconds by querying the domain registry directly (the parent zone), not a caching DNS resolver. That means we see your nameserver change as soon as your registrar publishes it, without waiting for DNS caches to expire — usually within a minute of saving the change at your registrar.

You can also trigger a check on demand with the Check now button in the dashboard, or via the API:

curl -X POST https://api.deploybase.eu/api/v1/domains/DOMAIN_ID/check-delegation \
  -H "Authorization: Bearer $TOKEN"

The response reports whether delegation was detected, the nameservers we expect, the nameservers your domain currently publishes, and whether DNSSEC is enabled at the registry. If delegation is confirmed, the check completes setup immediately. Rate limited to once per 60 seconds per domain.

DNSSEC must be disabled before delegating

If your domain has DNSSEC enabled at the registry (a DS record at the parent zone), disable it at your registrar before switching nameservers. The deploybase-hosted zone is not signed, so with a stale DS record in place, validating resolvers reject every answer and your domain becomes unreachable for many visitors — even though the nameservers are correct. The dashboard warns you when a check detects DNSSEC on your domain.

Beta. Managed DNS is fully functional but new. Note that nameserver delegation moves all DNS for the domain to deploybase. Existing MX and TXT records (email, SPF) are imported automatically when the zone is created, but records on subdomains we can’t discover — DKIM selectors, for example — need to be re-added in the domain’s DNS records panel before you switch the nameservers. Compare the created zone against your current records before delegating.

Removing a Domain

curl -X DELETE https://api.deploybase.eu/api/v1/domains/DOMAIN_ID \
  -H "Authorization: Bearer $TOKEN"

Removes the domain, SSL certificate, and CDN hostname mapping. Traffic falls back to the default {slug}.sites.deploybase.eu URL. The domain can be re-added later.