How SSL works

DoDomain is a DNS layer, not a proxy. We get your users' domains pointed at your infrastructure and prove when the records are live — then TLS terminates at your host, with certificates it issues, exactly as if the user had configured DNS by hand.

The model

A connect session writes (or guides the user to write) records like CNAME app.customer.com → edge.yourproduct.com. Once verified, requests to app.customer.com resolve straight to your load balancer or hosting platform — DoDomain is not in the request path. No traffic transits our servers, we hold no private keys for your users' domains, and an outage on our side cannot take a connected domain down.

The corollary is honest and worth stating plainly: because we never terminate your traffic, we also don't provision certificates for it. Proxy-style competitors do — by sitting in front of your product forever. With DoDomain, certificate issuance stays where your TLS already lives, and on modern hosts that is automatic. The one thing issuance always waits on — DNS actually pointing at you — is exactly what connection.verified tells you.

What records to mint

For subdomains (app.customer.com), a CNAME to your ingress hostname is the norm. For apex domains (customer.com), CNAMEs are not allowed by DNS itself — mint A/AAAA records to your static IPs, or the flattened/alias target your host documents. See Apex domains for what each tier does with an apex request and the patterns that work. Add a TXT record when your platform (or your own logic) wants a domain-ownership proof before serving.

Per-host notes

Vercel

Add the customer domain to your project (dashboard or the Domains API) and point the DoDomain session's CNAME at the target Vercel gives you (typically cname.vercel-dns.com). Vercel provisions and renews the certificate automatically once DNS resolves — connection.verified is your signal that issuance can proceed.

Cloudflare (for SaaS)

With Cloudflare for SaaS, create a custom hostname for the customer domain and have the session CNAME point at your zone's fallback origin. Cloudflare validates via DNS and issues the edge certificate. This pairs well with DoDomain's one-click tier — a customer already on Cloudflare authorizes the record write in a single OAuth consent.

Caddy / nginx (self-hosted)

Caddy's on_demand_tls issues a certificate the first time a new hostname hits your server — pair its ask endpoint with your own record of connected domains (populate it from connection.verified). On nginx, run certbot or acme.sh with HTTP-01 per domain after the webhook lands, then reload.

Render / Fly.io

Both issue certificates automatically once the domain is added to the service and DNS points at them: Render under Settings → Custom Domains, Fly via fly certs add customer.com. Add the domain on your host when you mint the DoDomain session; issuance completes when the records the session wrote go live.

The sequence, whatever the host

Add the domain on your platform, mint the DoDomain session pointing at it, and treat connection.verified as the "DNS is live — certificates can issue" trigger.