DoDomain vs SaaS Custom Domains

The phrase is on their homepage and it is easy to read as more than it says. Per their features page it is automated DNS configuration emails and validation for your customers. Their API docs name the field: instructions_recipient is the email address where the instructions to add the CNAME record will be sent. We found no statement that it writes the record into the customer's own DNS provider, so this page treats it as instructions plus validation.

That is a useful feature and a common one. It moves the instructions out of your UI and into an inbox. It does not remove the step where a non-technical customer opens a DNS dashboard, finds the right zone and types a host value into the wrong field. That step is where DoDomain sits: on Pro and above the session picks a Cloudflare OAuth approval or a signed Domain Connect apply when the customer's provider allows it, and every other provider gets step-by-step records for that provider's dashboard with a live status per record.

The validation half is where they are closer to us than the old version of this page said. Their webhooks include a Domain DNS Proxy Record Valid event, fired when a CNAME successfully points the custom domain at their proxy, and a matching Invalid event for when the CNAME cannot be found, with a last_dns_check_at field. The checks target their own proxy record. DoDomain's proof is read at the domain's authoritative nameservers for whatever records your session asked for, which can include a TXT record or a record that points at a host other than a proxy.

Per their FAQ, SaaS Custom Domains generates certificates with Let's Encrypt and ZeroSSL. Each domain has a challenge_type of http01, which issues on demand, or dns01, which issues once the _acme-challenge records are found. Subdomains, apex domains and wildcards are all documented, and a wildcard can use on-demand certificates for each subdomain. If you have a customer who must bring their own certificate, custom certificates are supported. DoDomain issues no certificates, so none of this has a counterpart on our side.

Their REST API covers accounts, upstreams, custom domains, rules, custom certificates, redirects and analytics, with bearer-token auth. Their webhooks cover domain created and deleted, the DNS proxy record and DNS challenge record valid and invalid events, proxy deployment complete, and certificate issued and revoked. Per their docs, a delivery has a 5-second timeout and is retried up to 10 times with exponential backoff, and each request carries a token in the query string. We do not quote their rate limit: their docs and FAQ disagree about it.

DoDomain's surface is narrower in scope and different in kind: sessions, connections and events for the DNS step, a published OpenAPI 3.1 document, three npm packages and a Python SDK, and an MCP server with eight tools over OAuth 2.1. If you already integrate their API, adding ours is one more route that receives one more signed webhook.

SaaS Custom Domains meters domains served. Per its homepage you start with 100 domains at $0.29 per domain, which is $29 a month, and get automatic discounts up to 50% as you scale. The sliders that set the schedule are rendered in JavaScript and we could not read the steps between, so the table below shows the range those two published bounds imply rather than a point estimate. Its FAQ says bandwidth is not charged extra, which removes one variable that most proxy bills carry.

DoDomain meters a verified connection, once, in the month it first goes live. Monitoring and re-checks are free and uncapped, so domains that stay live for years add nothing after the month they arrived. The scenarios price each side on its own meter: new domains per month for DoDomain, domains live at once for SaaS Custom Domains.

List prices, monthly billing. DoDomain counts a domain once, in the month it first verifies; re-checks and drift monitoring are free on every plan, so live domains add nothing. One-click setup starts on Pro: a cheaper plan above is the guided-records flow. The SaaS Custom Domains column is its published domain price only. Above 100 domains it shows the range between the full per-domain price and the maximum 50% discount, because the schedule in between is not published on a page we could read. Enterprise and self-hosted deployments are quoted by contacting sales and are not priced here.

Two readings. A product with many customers and a stable list will pay the proxy line far more than the DNS line, and the proxy line is the one worth negotiating. A product that onboards in bursts and routes most traffic through its own infrastructure may find the DNS line is the only one it needs. See pricing for what each DoDomain plan includes.

On this page DoDomain gets the record into the customer's DNS and proves it, and SaaS Custom Domains serves the traffic. So the record in the session points at their edge. Per their custom-domains guide, a subdomain takes a CNAME to in.saascustomdomains.com, and the guide also describes pointing a CNAME on your own domain at it first, so customers create one stable record.

An apex needs a different record: their guide says two A records at the addresses they publish, so pass those as A records instead. A CNAME cannot exist at a zone apex whichever vendor you use.

// 1. Your server: mint a connect session for the customer's domain.
import { DoDomain, verifyWebhook } from "@dodomain/node";
import { env } from "./env"; // your validated server env

const dodomain = new DoDomain({ secretKey: env.DODOMAIN_SECRET_KEY });
const session = await dodomain.sessions.create({
  domain: "customer.com",
  records: [
    { type: "CNAME", host: "app", value: "in.saascustomdomains.com" },
  ],
  returnUrl: "https://yourapp.com/settings/domains",
});

// 2. Your page: open the connect sheet with session.token.
import { showDoDomain } from "@dodomain/connect";

showDoDomain({ token, onVerified: ({ domain }) => markDomainLive(domain) });

// 3. Your webhook route: DoDomain calls it once the record is live at the
//    domain's authoritative nameservers, and again if it ever breaks.
if (!verifyWebhook(env.DODOMAIN_WEBHOOK_SECRET, rawBody, signatureHeader)) {
  return new Response("bad signature", { status: 400 });
}

From Pro up, the session picks the path on its own: a Cloudflare-hosted domain gets the OAuth one-click, a provider that has enabled DoDomain's Domain Connect templates gets a signed apply, and every other provider gets step-by-step records for that provider's dashboard. On the free plan every provider gets the step-by-step records. The full walkthrough is in the quickstart.

Take the record value SaaS Custom Domains tells your customer to create, pass exactly that record to POST /api/v1/sessions, and hand your customer the returned connectUrl, or embed the @dodomain/connect sheet in your own onboarding. When the signed connection.verified webhook arrives, the record exists at the customer's authoritative nameservers and the edge can serve the hostname. Nothing about your proxy, hosted or self-hosted, changes.

You can turn off the instructions email for the customers DoDomain handles and keep it for the rest, because the two systems share no state. Each side reports through its own webhook, and your server decides which signal activates the tenant.

• You need HTTPS on customer domains and have no proxy: SaaS Custom Domains does that and DoDomain does not. Start there, and add DoDomain only if the DNS step is where customers stall.
• Your customers are technical and an emailed CNAME instruction is enough: you do not need a second vendor.
• Your customers use many registrars and abandon at the record step: add DoDomain. The Cloudflare and Domain Connect paths remove the copy-and-paste for the providers that allow it, and the proof tells you which customers actually finished.
• You run SaaS Custom Domains self-hosted: DoDomain works the same, because it needs the record value and never access to your edge.

Leaving SaaS Custom Domains later costs you a record change: swap the record value in your session payload and DoDomain guides the same customers through the new one.

A practical test before committing: take ten real customer domains from your last month of signups, count how many reached a working record without help, and note which providers the rest were on. If the failures cluster on providers that support Domain Connect or are on Cloudflare, the one-click paths will remove most of them. If they are spread across small registrars, the guided steps and the live per-record status are the part that helps.

Their SLA page commits to 99.9% uptime per calendar month. Their homepage lists higher figures elsewhere, and we quote only the SLA because it is the commitment a contract would hold them to. Support is 24/7 by email and web chat; phone support and the 1, 6, 12 and 24 hour response tiers are described as part of the Enterprise package, along with a dedicated technical account manager and custom SLAs.

On compliance, their Enterprise self-hosted offer is described as built for SOC 2, HIPAA and other enterprise frameworks. That is a statement about the design, not a certification, and we read it that way. They publish a data processing agreement and a sub-processor list that names AWS among others. If your buyers send security questionnaires, ask for the current documents rather than relying on the homepage.

DoDomain's exposure is narrower because it carries no traffic and issues no certificates: it reads DNS and sends signed events. That makes the review shorter, and it also means there is no SLA on your customers' page loads to compare against theirs.

It serves traffic. Automatic certificates through Let's Encrypt and ZeroSSL, custom certificate support, wildcard domains, a WAF, DDoS protection, rate limiting, redirects and rules are all part of the product, and DoDomain never will do any of it (per saascustomdomains.com, retrieved 2026-10-06).

A flat $29 for 100 domains with no bandwidth charge is a simpler line item than a connection allowance, and the discount bound is published. It also publishes an SLA of 99.9% uptime per calendar month with service credits, and offers 24/7 support by email and web chat. DoDomain does not publish an equivalent traffic SLA because it carries no traffic.

Its webhooks include DNS proxy record valid and invalid events, which are a drift signal for the record that matters most to its own product. It offers a self-hosted deployment for teams that must run the edge themselves, a native Bubble.io integration, and an option that puts Cloudflare in front for DDoS, CDN and WAF.

Where DoDomain earns its place is the step every proxy leaves to the customer: writing the record through their provider where it can, guiding it precisely where it cannot, proving it at the source, and monitoring it for free, with no proxy in your request path and no bandwidth on the invoice.

No card, no sales call: create an app, mint a session, and watch the first domain verify.

• Every custom-domain option compared
• Entri alternative
• customdomain.ai alternative
• DoDomain vs Domainee
• DoDomain vs SaaSKevin
• With Cloudflare for SaaS
• With Approximated
• State of Domain Connect: which DNS providers support one-click