Compare
DoDomain with Cloudflare for SaaS
These are not competitors, and pretending otherwise would waste your time. Cloudflare for SaaS terminates traffic on your customers' hostnames — certificates, routing, WAF. DoDomain does the half that happens first: getting the DNS records created in the customer's own registrar and proving they are live. This page is about the seam between them. Cloudflare's figures are as published on developers.cloudflare.com, retrieved 2026-08-26 — check their site for current packaging.
Who does which half
| DoDomain | Cloudflare for SaaS | |
|---|---|---|
| Gets the customer's DNS records created | Yes — Cloudflare OAuth one-click, Domain Connect where the provider has enabled it, guided per-provider steps everywhere else | No — the customer still has to create the record in their own DNS provider |
| Proves the records are live | Yes — queried at the domain's authoritative nameservers, not a UI checkbox | Handles the domain validation its own certificates require |
| Terminates TLS on the customer's hostname | No, by design — traffic never touches DoDomain | Yes — that is the product |
| Watches for DNS drift after go-live | Yes — on every plan, including Free | Not part of a proxy's job |
| Apex (zone-root) hostnames | A/AAAA/TXT/MX at the apex on every plan and every connect tier | Apex custom-hostname support is listed as Enterprise (per developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/plans/, retrieved 2026-08-26) |
| What you pay for | Verified connections per month — a connection counts once, on its first verification; 50 of them on Free | Custom hostnames served: first 100 included, then $0.10 per hostname per month to 50,000, Enterprise above (per developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/plans/, retrieved 2026-08-26) |
Apex domains: where the two products disagree about tiers
Customers type the bare domain. On Cloudflare's published plans page (per developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/plans/, retrieved 2026-08-26), apex custom-hostname support is listed as Enterprise, alongside BYOIP — so serving acme.com itself, rather than only app.acme.com, is a tier decision on the traffic side.
On the DNS side it is not. Apex records — A, AAAA, TXT and MX at @ — are guided and verified on every DoDomain plan and every connect tier, Freeincluded, and the Cloudflare one-click path writes them through the user's own OAuth grant.
Being precise about the apex, because it matters and because it also limits us: a CNAME can never exist at a zone apex — that is RFC 1034 §3.6.2 and RFC 2181 §10.1, not a product decision — and DoDomain does not write the non-standard ALIAS/ANAME records some providers offer instead. What it does is know which providers have that feature, tell your customer the right thing for theirs, and verify the result. The apex guide is the honest, provider-by-provider version.
And then nobody watches the record again
A proxy's job starts when a request arrives. If your customer edits their zone six months from now and the record stops pointing at you, no request arrives — so nothing upstream of the proxy notices, and the first signal is usually the customer.
DoDomain keeps reading authoritative DNS after go-live: every 10 minutes for a connection's first day, then hourly for a week, then every 6 hours, with suspected drift confirmed before you are told. connection.failed names the exact failing records; connection.verified fires again with a recovery signal when they come back. Both are HMAC-SHA256-signed and both are on every plan, Freeincluded — this is the part of the lifecycle that is nobody else's job in the stack.
Wiring them together
The integration is small because the handoff is narrow. Add the custom hostname in Cloudflare for SaaS as you already do; take the record values Cloudflare tells you the customer must create; pass exactly those records to POST /api/v1/sessions and hand your user the returned connectUrl — a hosted page, or the @dodomain/connect widget embedded in your own onboarding.
Your customer then gets a real path instead of a record to copy: if their domain is on Cloudflare, a scoped OAuth approval on Cloudflare's own page writes it; if their provider has enabled our Domain Connect templates, a signed one-click apply writes it; otherwise they get their provider's dashboard link, its host-field quirks, and a live status per record.
When the signed connection.verifiedwebhook reaches your server, the records are confirmed live at the domain's authoritative nameservers — that is your cue to activate the tenant. Nothing about your Cloudflare setup changes.
When you don't need DoDomain here
Honest flip side. If your customers' domains are already inside your own Cloudflare account, the DNS step is yours to make and there is nothing to guide. If you only onboard a handful of enterprise customers a year, a support engineer on a call solves this more cheaply than any vendor. And if the record your customers must create is genuinely one CNAME on a provider they all share, a good copy-paste screen may be enough.
DoDomain earns its place when self-serve customers arrive on 20 different registrars and the DNS step is where they stall — and it never asks you to move traffic to find out, because it is never in the request path.
Frequently asked questions
Is DoDomain an alternative to Cloudflare for SaaS?
No — they solve different halves of the same problem. Cloudflare for SaaS terminates traffic on your customer's hostname: it issues and renews the certificate and routes the request to your origin. DoDomain is the step before that: it gets your customer to create the DNS records Cloudflare needs, applies them one-click where it can, verifies them against the domain's authoritative nameservers, and tells your server when they are live. DoDomain never proxies traffic and never issues certificates, so it cannot replace Cloudflare for SaaS. What it adds is the half no proxy can reach: a record inside the customer's own registrar, which only the customer can authorize.
Do I still need a custom-hostname provider if I use DoDomain?
Yes, if your product is reached over HTTPS on your customer's domain. Something has to hold a certificate for that hostname and route the request — Cloudflare for SaaS, another proxy, or your own platform's custom-domain support. DoDomain's job ends at proof that the DNS is correct.
What does Cloudflare for SaaS cost?
As published on Cloudflare's Cloudflare for SaaS plans page (retrieved 2026-08-26), the first 100 custom hostnames are included, additional hostnames are $0.10 per hostname per month up to 50,000, and volumes beyond that are Enterprise. Apex (zone-root) custom-hostname support and BYOIP are listed as Enterprise. Check developers.cloudflare.com for current packaging.
Does DoDomain charge extra for webhooks?
No. HMAC-SHA256-signed webhooks are on every DoDomain plan, including Free at $0 forever — connection.verified when a domain goes live, and connection.failed when a connected domain's records later drift, with the failing records named in the event. That is a statement about DoDomain only; how any other vendor packages its notifications is theirs to publish.
Does DoDomain support apex (root) domains?
Yes, on every plan, with one hard limit that is DNS's and not ours. A, AAAA, TXT and MX records at the zone apex are guided and verified on every connect tier, and the Cloudflare one-click path writes them through the user's own OAuth grant. A CNAME cannot exist at a zone apex at all (RFC 1034 §3.6.2 / RFC 2181 §10.1), so if your edge is reachable only by hostname, your customer needs their provider's ALIAS, ANAME or CNAME-flattening feature — DoDomain does not create those records for them. The apex guide at dodomain.io/docs/apex-domains records, provider by provider, which ones offer it.
How do I wire the two together?
Add the custom hostname in Cloudflare for SaaS, take the record values Cloudflare tells you the customer must create, and pass exactly those records to POST /api/v1/sessions. Send your user the returned connectUrl. When the signed connection.verified webhook arrives, the records exist at the domain's authoritative nameservers and you can activate the tenant. Nothing about your Cloudflare configuration changes — DoDomain only replaces the copy-and-paste screen.