Skip to Content
CustomDomain

Domain verification without the DNS ticket

Your app picks the TXT record. CustomDomain™ writes it or shows the exact row, then checks it.

Start free trialRead the docs

For platform engineers at apps whose customers verify a domain.

Your appSettings

Verify acme.com

Add this TXT record to acme.com to turn on single sign-on.

TXT@pendingvendor-domain-verification=K7Qd2Lx9pT4w
Add it for meEmail it to IT
Cloudflare

Connect acme.com

We only get one-time permission to update DNS records.

Authorize with CloudflareAdd the records instead

Powered by CustomDomain™

acme.com moved to live when the TXT at acme.com carried your value. connection.live reached your server, and your app ran its own check.

Illustration with an example token. Widget lines read from its source on October 31, 2026.

What apps ask your customers to add

Formats from each service's own docs.

  • Sign-in and workspace claims

    Claude, Apple Business, Microsoft Entra ID, GitHub, Atlassian

    TXT acme.com anthropic-domain-verification-…=…
    Partial fit

    Records only. The claim check stays yours.

  • Search, ads and social

    Google Search Console, Meta, Pinterest, Bluesky

    TXT _atproto.acme.com did=did:plc:…
    Partial fit

    Records only. The service runs its own check.

  • Email sending

    Gmail and Yahoo, for bulk senders

    TXT _dmarc.acme.com v=DMARC1; p=none; rua=mailto:[email protected]
    Partial fit

    MX and the SPF merge are not value-checked.

  • App links and wallet files

    Apple and Android, from /.well-known

    GET acme.com/.well-known/apple-app-site-association
    Partial fitGrowth and up

    The edge forwards these paths to your app.

Not offered today: records that change once written, such as _acme-challenge, and SRV or NS records.

Written where the provider allows

  • sign in

    Written with their sign-in

    • Cloudflare
    • DigitalOcean
    • Vercel
    • Netlify
    • DNSimple
  • api key

    Written with their key

    • GoDaddy
    • IONOS
    • Porkbun
    • Amazon Route 53
  • by hand

    Shown, then checked

    • Namecheap
    • Squarespace
    • NameSilo

Names and logos belong to their owners. We write the records where the provider allows it and show the exact ones where it does not. A name here does not mean the provider endorses us.

One-click setup and the secure sign-in do not carry your record. There, your customer adds the row. Ways in from the provider census, read October 31, 2026. DNS provider directory

Cloudflare and the Cloudflare logo are trademarks and/or registered trademarks of Cloudflare, Inc. in the United States and other jurisdictions. Vercel, the Vercel design, Next.js and related marks, designs and logos are trademarks or registered trademarks of Vercel, Inc. or its affiliates in the US and other countries. DigitalOcean and all related logos are trademarks of DigitalOcean, LLC or its affiliates. dnsimple is a registered trademark of DNSimple Corporation.

Other TXT values at that name stay

CustomDomain™ reads what is already there and keeps it.

TXT records at acme.com
Already published
v=spf1 include:_spf.google.com ~allapple-domain-verification=0RaNdOm1LeTtErS2aNd3NuMbErS4
Added
vendor-domain-verification=K7Qd2Lx9pT4w

pending propagating live when a TXT at acme.com carries your value. Then it is checked hourly.

If that read fails, nothing is written. Drift alerts are not sent on the hosted service today.

From your server, in two calls

connection.live reaches your server when every record resolves. Then your app runs its own check.

Docs: WebhooksAPI: Share a connect flow

From your server, with an API key

Create the connection

POST /v1/connections
{"domain": "acme.com", "application_id": "app_…"}

Supply your record

PUT /v1/connections/con_…/records
{"records": [
  {"type": "TXT", "host": "@",
   "value": "vendor-domain-verification=K7Qd2Lx9pT4w"}
]}

Or email it to whoever runs the DNS

POST /v1/sharing/connect
{"domain": "acme.com", "recipient_email": "[email protected]",
 "note": "For our SSO setup"}

Request shapes from the OpenAPI spec, read October 31, 2026. Not a recorded run: test mode refuses supplied records today.

Common questions

Does CustomDomain™ verify the domain for my app?

No. It writes or shows your record and checks that a TXT at that name carries your value. The service that issued the token runs its own check. Your customer adds no record for CustomDomain™ itself.

Can the token change later?

Not in place. Once your record is written, the set is fixed. To change it, disconnect the domain and connect it again with the new record.

Does a domain used only for this count toward my plan?

Yes, as one domain connection. The edge does not serve it and it gets no certificate. Your first ten domains connect free.

Can I try it in test mode?

Not today. Supplying your own records is refused on test mode domains, so try it on a domain you own.

Anthropic, Apple, Microsoft, GitHub, Atlassian, Google, Meta, Pinterest, Bluesky, Yahoo and the DNS providers above own their names and logos, and none of them endorses CustomDomain™. Facts about their services were read on October 31, 2026.

Put your customers on their own domains.

Your first ten domains connect free. No card needed to sign up.

Start free trialBook a call