The state of custom domain infrastructure

What is in it

The paper takes the mechanics apart and then describes an architecture. It is written to stay useful to a reader who never buys anything.

The problem, mechanically

Why a CNAME cannot sit at a zone apex (RFC 1034), why a pre-existing CAA record blocks certificate issuance inside the CA rather than at the DNS write (RFC 8659), why there is no observable moment of propagation, and why a second SPF record breaks mail instead of adding a feature (RFC 7208).

The landscape and its costs

What teams do today, what each approach costs in support load, and what the standards actually cover. Domain Connect lists nine live DNS provider implementations. The paper uses our August 2026 census of 63 providers. As of October 2026 the census lists 189, and 73 have an automatic path.

A reference architecture

Provider detection, automatic write paths with a manual floor that is a first-class path rather than an afterthought, server-side record computation, a bounded propagation state machine, fail-closed certificate issuance, and drift detection after go-live.

Domain connection for AI agents

Why agent-driven onboarding changes the requirements: an agent cannot click through a registrar UI, must never hold the user's DNS credentials, and must not spend money unattended. How MCP plus scoped OAuth addresses each.

Security, trust and failure modes

Holding delegated DNS authority: scope, revocation, least privilege, tenant isolation, and an account of what happens when the system cannot write DNS or when a record drifts.

How to evaluate a solution

A vendor-neutral checklist you can apply to any provider, including building it yourself. Provider coverage and what "coverage" means, apex handling, CAA handling, TLS automation, what happens after connection, and how credentials are held.