Domain DNS

After you verify ownership, point the domain at Freestyle so public traffic can reach your VM.

Point the domain at beta-web.freestyle.sh with a CNAME. The addresses behind that name are ours to maintain, so your zone keeps working as our edge changes — a record that copies an address into your zone is yours to update instead.

Subdomain

For a subdomain such as app.example.com:

Type: CNAME
Name: app
Value: beta-web.freestyle.sh

Wildcard Subdomain

To route every subdomain under a domain:

Type: CNAME
Name: *
Value: beta-web.freestyle.sh

The DNS record is only half of it — a wildcard also needs a wildcard TLS certificate, and a rule routing the hostnames. See Wildcard Domains.

Apex Domain

DNS does not allow a CNAME at the apex of a zone, so example.com needs an ALIAS, ANAME, or CNAME-flattening record instead. Most providers offer one — Cloudflare, Route 53, and DNSimple among them:

Type: ALIAS
Name: @
Value: beta-web.freestyle.sh

It behaves like the CNAME above, tracking our addresses for you.

If your provider has no such record type, serve the site from www.example.com with an ordinary CNAME and redirect the apex to it. The dashboard lists the current edge addresses if you would rather publish them directly, but then keeping them current is on you.

Delegate The Certificate Challenge

Every custom domain needs one more record before HTTPS works. Freestyle proves control of your domain over DNS, which means publishing a record under it — so delegate that one subzone, and nothing else, to the Freestyle nameserver:

Type: NS
Name: _acme-challenge
Value: beta-dns.freestyle.sh

This is required for every domain, not only wildcards. Without it the rule is created and DNS resolves, but no certificate can be issued — the domain answers on port 443 and then fails the TLS handshake, because there is no certificate to present.

The delegation covers _acme-challenge.example.com alone. The rest of your zone stays entirely under your control, and leaving it in place is what lets certificates renew on their own.

Check DNS

DNS changes take time to propagate. Confirm the record resolves before you expect traffic to flow:

dig app.example.com CNAME +short
dig _acme-challenge.app.example.com NS +short

Expected answers:

beta-web.freestyle.sh.
beta-dns.freestyle.sh.

An empty second answer is the usual reason a domain resolves but will not serve HTTPS.

If the answer shows a name such as app.example.com.example.com, your DNS provider appended the zone name. Enter the relative name, app, instead of the full hostname.

Route Traffic

DNS only sends traffic to Freestyle. To send it on to a VM, create a TLS ingress rule:

await freestyle.tls.rules.create({
  action: "allow",
  domain: "app.example.com",
  source: { public: true },
  destination: { vmId: "your-vm-id", port: 3000 },
});

See TLS for the full rule grammar and cleanup examples.