Custom domains

Map your own domain to a Dockfly service. TLS certificates are issued and renewed automatically.

Every web service keeps an automatic Dockfly fallback address. A user-selected name.dockfly.app address and a domain you own are configured through separate sections.

Choose a Dockfly subdomain

Open the service's Networking tab and enter a name under Custom Dockfly Subdomain. Dockfly checks global availability, creates the route, and enables TLS without asking you to configure DNS. The generated fallback address continues to work.

One selected Dockfly subdomain can be active per web service. Released names are quarantined for 30 days before they can be claimed again.

Add a domain you own

From a service's Networking tab, click Add Custom Domain and enter the hostname (e.g. app.example.com). This separate path tells you which DNS records to set, then verifies them before the certificate is issued.

DNS configuration

Subdomain (recommended) — CNAME

For any subdomain (apex domains can't use CNAMEs in most providers), point a CNAME at the Dockfly load balancer. This keeps the IP under our control and lets us route around incidents.

dns

Type:   CNAME
Name:   app
Value:  edge.dockfly.app
TTL:    300

That maps app.example.com → Dockfly. No further setup.

Apex domain — A record (or ALIAS / ANAME)

Most DNS providers don't allow CNAMEs at the apex (example.com with no subdomain). Use either:

dns

# Option 1: A record (works everywhere, IP is stable but not flexible)
Type:   A
Name:   @
Value:  116.202.19.147
TTL:    300

# Option 2: ALIAS / ANAME (Cloudflare, DNSimple, Route53)
Type:   ALIAS
Name:   @
Value:  edge.dockfly.app
TTL:    300

If you use Cloudflare with proxy mode (the orange cloud), set TLS mode to Full (strict). Otherwise, certs will fail to issue.

TLS certificates

Dockfly issues a Let's Encrypt certificate as soon as DNS resolves. We renew 30 days before expiry and rotate seamlessly.

For wildcard certs (e.g. *.example.com), Dockfly uses the DNS-01 challenge — supported on Cloudflare, Route 53, DigitalOcean, and most major providers. Check the dashboard for the full list.

Common issues

“Certificate pending” for > 5 min

Usually a DNS issue. Run dig +short app.example.com and check that it returns a Dockfly value. If you just changed the record, wait one TTL cycle (often 5 minutes).

“CAA record blocking issuance”

If you have a CAA record on the apex, allow Let's Encrypt:

dns

Type:   CAA
Name:   @
Value:  0 issue "letsencrypt.org"

← Deploy from Git

Environment variables →