CUSTOM DOMAIN
Whitepaper
The State of Custom Domain Infrastructure
Why DNS onboarding breaks, and how programmatic domain connection fixes it. A technical reference for engineers and product teams who let customers bring their own domain.
29 pages · v1.0, August 2026 · No email required.
What is in it
The paper takes the mechanics apart and then describes an architecture. It is written to stay useful to a reader who never buys anything.
- The problem, mechanically
- Why a CNAME cannot sit at a zone apex (RFC 1034), why a pre-existing CAA record blocks certificate issuance inside the CA rather than at the DNS write (RFC 8659), why there is no observable moment of propagation, and why a second SPF record breaks mail instead of adding a feature (RFC 7208).
- The landscape and its costs
- What teams do today, what each approach costs in support load, and what the standards actually cover. Domain Connect lists nine live DNS provider implementations; in our own 63-provider census, 38 have no automated write rail at all.
- A reference architecture
- Provider detection, one-click authorization rails with a manual floor that is a first-class path rather than an afterthought, server-side record computation, a bounded propagation state machine, fail-closed certificate issuance, and drift detection after go-live.
- Domain connection for AI agents
- Why agent-driven onboarding changes the requirements: an agent cannot click through a registrar UI, must never hold the user's DNS credentials, and must not spend money unattended. How MCP plus scoped OAuth addresses each.
- Security, trust and failure modes
- Holding delegated DNS authority: scope, revocation, least privilege, tenant isolation, and an honest account of what happens when the system cannot write DNS or when a record drifts.
- How to evaluate a solution
- A vendor-neutral checklist you can apply to any provider, including building it yourself. Provider coverage and what "coverage" honestly means, apex handling, CAA handling, TLS automation, what happens after connection, and how credentials are held.
Every product claim in the paper is verified against the running codebase, and every external claim carries a citation. Vendor-published figures, including competitors', are labelled as attributed claims rather than presented as independent research. Where a widely repeated industry statistic could not be traced to a primary source, the paper says so instead of quietly reproducing it.