# Serverless Custom Domains

Add your own domain to any serverless container with automatic TLS certificates via Let's Encrypt. Each container supports up to 10 custom domains.

## Default domain

Every container gets an auto-generated domain:

```
https://{container-slug}-{team-name}.danubedata.run
```

This domain is always available, even without custom domains configured. It uses a managed wildcard TLS certificate.

## Adding a custom domain

1. Navigate to the container detail page
2. Click **Manage Domains** from the Actions dropdown (or the **Manage** button in Connection Details)
3. Click **Add Domain**
4. Enter your domain (e.g., `api.example.com`)
5. Click **Add**

The domain is created with **Pending** verification status.

## Domain verification

After adding a domain, you must verify ownership by adding a DNS TXT record at your DNS provider.

### Step 1: Get the verification token

The dashboard shows the required TXT record after adding a domain:

- **Record name:** `_danubedata-verify.your-domain.com`
- **Record value:** The verification token (64-character hex string)

### Step 2: Add the DNS record

At your DNS provider (Cloudflare, Route53, Namecheap, etc.), create a TXT record:

| Type | Name | Value |
|------|------|-------|
| TXT | `_danubedata-verify.your-domain.com` | `(token from dashboard)` |

The dashboard shows the exact **Host** (record name) to enter, with a live preview as you type. Most DNS editors append your zone's domain to the Host field automatically — so if you're editing the zone for `example.com`, enter just `_danubedata-verify` (not `_danubedata-verify.example.com`), or the name ends up doubled as `_danubedata-verify.example.com.example.com`. When in doubt, follow the preview shown in the dashboard.

### Step 3: Verify

Before clicking Verify, you can confirm the record has resolved with a ready-to-copy command:

```bash
dig +short TXT _danubedata-verify.your-domain.com
```

When it returns your token, click **Verify** in the dashboard. DanubeData checks for the TXT record.

DNS propagation can take a few minutes. If verification fails, wait and try again. The verification window is 72 hours, and up to 20 verification attempts are allowed.

## Connecting your domain

After verification, create a CNAME record pointing your domain to your container:

| Type | Name | Value |
|------|------|-------|
| CNAME | `api.example.com` | `my-api-acme.danubedata.run` |

For **root domains** (apex domains like `example.com`), use an ALIAS or ANAME record if your DNS provider supports it. Not all DNS providers support CNAME on root domains.

Once the CNAME is in place, a TLS certificate is provisioned automatically via Let's Encrypt and cert-manager.

## Domain statuses

### Verification status

| Status | Description |
|--------|-------------|
| **Pending** | Awaiting DNS TXT record |
| **Verifying** | DNS check in progress |
| **Verified** | Domain ownership confirmed |
| **Failed** | Verification failed — check your DNS records and retry |

### TLS status

| Status | Description |
|--------|-------------|
| **Pending** | Awaiting TLS certificate provisioning |
| **Provisioning** | Certificate being generated via Let's Encrypt |
| **Active** | HTTPS is active with a valid certificate |
| **Failed** | Certificate provisioning failed — ensure CNAME is correct |
| **Expired** | Certificate has expired — re-verify and check DNS |

### Deployment status

| Status | Description |
|--------|-------------|
| **Pending** | Domain not yet deployed to the container |
| **Deploying** | Domain being added to the Knative Service |
| **Active** | Domain is live and routing traffic |
| **Removing** | Domain being removed |
| **Failed** | Domain deployment failed |

## Setting a primary domain

You can designate any verified, active domain as the primary domain:

1. Navigate to **Manage Domains**
2. Click **Set as Primary** next to the domain

The primary domain is used as the canonical URL for your container.

## Removing a domain

1. Navigate to **Manage Domains**
2. Click **Delete** next to the domain
3. Confirm deletion

After removing a domain from DanubeData, you should also remove the CNAME and TXT records from your DNS provider.

## Bulk operations

The domains management page supports bulk operations:

- **Bulk verify** — Verify multiple domains at once
- **Bulk delete** — Remove multiple domains at once

## Troubleshooting

### Verification fails

- Ensure the TXT record name is exactly `_danubedata-verify.your-domain.com`
- Check that the token value matches exactly (no extra spaces)
- Wait 5-10 minutes for DNS propagation before retrying
- Use `dig TXT _danubedata-verify.your-domain.com` to confirm the record is visible

### TLS certificate not provisioning

- Verify that the CNAME record points to your container's auto-generated URL
- Check that the CNAME has propagated: `dig CNAME your-domain.com`
- Ensure your domain is not behind a proxy (e.g., Cloudflare orange cloud) during initial provisioning — switch to DNS-only mode temporarily

### Domain shows as "Failed"

- Check that the domain is not already in use by another DanubeData container
- Verify DNS records are correct
- Try removing and re-adding the domain

## Next steps

- [Serverless overview](https://docs.danubedata.ro/serverless-overview) — Full feature documentation
- [Invoking containers](https://docs.danubedata.ro/serverless-invoking) — Code examples for your custom domain
- [Authentication](https://docs.danubedata.ro/serverless-authentication) — Secure your endpoints

---

**Questions?** Contact support at support@danubedata.ro