Connect your own domain

By default your site is tollable at a subdomain we give you (yourname.naulon.app). This page moves it to your own domain, www.yoursite.com or yoursite.com. The certificate is issued and renewed at the edge; you never manage TLS.

What you'll do

You prove you own the domain, then point it at us. The certificate follows from the routing record; there's no separate record for it.

1. In the dashboard, open Sites → Manage → Connection → Domains and click Add.
2. Enter your domain and pick how you'll prove it's yours (below). Add the record we show you at your DNS provider, then click Verify.
3. Once you're verified, add the routing record so live traffic starts reaching us (skip this if you proved ownership with the CNAME method, which does both in one record).

Proving ownership

You add one record at the DNS provider your nameservers point to (often the registrar, or Cloudflare, Route 53 and so on), or a tag or file on your site. There are four methods, and you can switch between them before you verify:

• DNS TXT record (recommended). Add a TXT record at your DNS provider. Nothing on your live site changes, and it works on a root domain or a subdomain alike.

• Meta tag. Add a tag to your homepage.

• File upload. Serve a small file at a known path on your site.

• Routing record (CNAME), subdomains only. One record proves ownership and starts routing live traffic at once:

  www.yoursite.com   CNAME   customers.naulon.app

  A root/apex domain (yoursite.com with no www) can't use a plain CNAME for this, because DNS providers flatten it before it reaches us: prove with a TXT record instead, then add the routing record (below) as its own step.

To change method later, use ← Use a different method on the domain's card. The domain and the claim stay the same.

Pointing your domain at us

Once you're verified (or you used the CNAME method above, which already routes), add the routing record to send live traffic through us:

www.yoursite.com   CNAME   customers.naulon.app

A root/apex domain can't use a plain CNAME here either. Use your provider's CNAME-flattening / ALIAS / ANAME record type with the same target, or open a support thread.

After you verify

• Certificate status shows in the dashboard: issuing while the edge validates and mints the certificate off the routing record (usually a few minutes), then active. Renewal works as long as the routing record stays in place.
• Once active, https://www.yoursite.com serves through us with a valid certificate, and the toll applies to your articles as it did on the subdomain.
• Your origin server needs no certificate for the custom domain and is never exposed directly: the edge terminates TLS and forwards to us.

If verification says "not yet"

DNS takes time to propagate. If Verify reports the records aren't visible, wait a few minutes and try again. You can re-verify as often as you like.

Waiting never fixes a proxied record. If your DNS provider proxies the hostname (Cloudflare's orange cloud, and the equivalent elsewhere), the proxy replaces your CNAME with its own addresses, so we cannot read it, and the dashboard says so. Turn the proxy off for that record (grey cloud / DNS only), or prove ownership with a TXT record, which resolves normally through a proxy and leaves live traffic alone.

If your origin has its own bot or rate protection

Once traffic routes through us, every request to your origin comes from one fixed naulon address instead of thousands of visitor IPs. If your origin sits behind its own bot-management or rate-limiting edge (a hosting firewall, Cloudflare in front of your origin, AWS WAF), that edge can read it as a single-source flood. Full page loads usually survive, because a browser can solve a JavaScript challenge; background requests (prefetches, fetch and XHR, feed pulls) can't, so they fail intermittently and the site feels slow or half-broken.

The fix is a shared secret naulon sends on every request to your origin, which you match at your edge. It does not depend on our IP. In your domain's settings, under Protect your origin, click Generate secret and copy it; it is shown once. naulon sends it as the header x-naulon-origin-auth. Add a rule at your edge that trusts a request carrying that header with your secret and skips your bot and rate challenges:

• Cloudflare (in front of your own origin). A WAF custom rule: when the header equals your secret, action Skip the remaining rules.
• Vercel. A firewall rule matching the header, action Bypass. Custom rules are on every Vercel plan. A Bypass skips the firewall only, not Vercel's own system rate limiting; protect your origin covers that case.
• AWS WAF or ALB. A string-match rule on the header equal to your secret, action Allow, ordered ahead of your rate and bot rules.
• An application-level check. Treat a request carrying the header and your secret as trusted.

Step-by-step per platform, with the exact rule to paste, is in protect your origin.

Then click Verify. We fetch your origin from our own address three times: with no header, with a deliberately wrong secret, and with the correct one, and report whether the bypass works. The wrong-secret probe catches a rule that only checks the header is present; protect your origin lists what each verdict means. Regenerating the secret breaks the bypass until you update your edge rule, so update both together.

If your platform can only match by IP (some plans, notably Vercel Free, challenge before your own rules run), exempt naulon's egress address instead. The Protect your origin panel shows it. Then:

• Vercel. vercel firewall system-bypass add <ip>; it exempts the IP from automatic mitigation and takes effect immediately.
• Cloudflare. An IP Access rule (or WAF skip) for that address.
• AWS WAF or ALB. Put the address in an allow IP set ahead of your rate and bot rules.

If your origin runs an application-level bot check, leave it off the routes we proxy. We have already classified human against agent before the request reaches you.

Removing a domain

Removing a custom domain stops tolling on it and releases the certificate. Your subdomain (yourname.naulon.app) keeps working.