# Custom domains

> Serve an Ownkube Compute app from a subdomain or root domain you own. Add the host, set two DNS records, and Ownkube issues and renews the certificate.

Every public web app gets a hostname under `ownkube.app`. You can also serve it from a domain you own, such as `app.example.com` or `example.com`. You add the host on the app itself, and Ownkube issues its HTTPS certificate and renews it.

Your DNS stays at your provider and your nameservers don't move. Each host needs two records, and the dashboard shows you exactly what to enter.

## Plans

| Plan | Custom domains |
|---|---|
| Pay as you go | Not included |
| Personal | 3 |
| Team | 20 |

Each host counts as one custom domain, so `www.example.com` and `example.com` are two. The count covers every app in the organization. See [Plans](/docs/billing/plans).

## Before you start

- A public web app on Ownkube Compute, with public access saved. See [Public hostnames](/docs/networking/public-hostnames).
- Access to the DNS records for your domain, at Cloudflare, Route 53, Namecheap or any other provider.

## Add a domain to an app

1. Open the app, go to **Settings**, then **Networking**. **Custom domains** sits under the app's address.

2. Enter the host you want, for example `app.example.com`, and select **Add**. To serve the root domain, enter `example.com` itself. A root domain is only served when you add it, so add `www.example.com` and `example.com` separately if you want both.

3. Add the two records the dashboard shows at your DNS provider. Copy the type, name and value exactly as shown.

4. The host moves through **Waiting for DNS**, **Issuing certificate** and **Verifying** to **Active**. Once it is active, the app answers on `https://app.example.com`.

Each host points at one app at a time. To move it, remove it from the first app and add it to the other.

The CLI and MCP can also add, list, verify and remove custom domains on Compute apps.

## The DNS records

Every host gets two records:

| Record | Type | Name | What it does |
|---|---|---|---|
| HTTPS certificate | `CNAME` | `_acme-challenge.app.example.com` | Lets Ownkube issue and renew the certificate for this host |
| Traffic routing | `CNAME`, or `ALIAS` on a root domain | `app.example.com` | Points the host at your app's region |

The routing record points at the edge name for the region the app runs in:

| Region | Edge name |
|---|---|
| Europe (Germany) | `eu1-edge.ownkube.app` |
| Asia (Mumbai) | `ap1-edge.ownkube.app` |

A subdomain such as `app.example.com` takes a `CNAME` to the edge name. A root domain such as `example.com` can't hold a `CNAME`, so it takes an `ALIAS` record to the same edge name. Providers also call it `ANAME` or CNAME flattening. If yours doesn't support it, serve the app from a subdomain such as `www.example.com`.

The dashboard always shows the exact names and values to copy, with a status next to the host.

## Troubleshooting

<details>
<summary>A host stays on Waiting for DNS</summary>

The record hasn't reached public DNS yet, or it was created on a different name. Check it from outside your network:

```bash title="Terminal"
dig +short _acme-challenge.example.com CNAME
dig +short app.example.com
```

Each should return the value the dashboard shows. Some providers add the domain to the name for you, so `_acme-challenge.example.com` entered in full can end up as `_acme-challenge.example.com.example.com`.

</details>

<details>
<summary>I use Cloudflare</summary>

Set the `_acme-challenge` record to **DNS only** (grey cloud). A proxied record hides the value Ownkube needs to see.

</details>

<details>
<summary>I want to run the app in my own AWS account</summary>

Custom domains work there too. You connect a domain once on the cluster, then link hosts under it per app. See [Custom domains in your own cloud](/docs/own-cloud/custom-domains).

</details>

- [Public hostnames](/docs/networking/public-hostnames)
- [Plans](/docs/billing/plans)

---

**Don't see a feature you need?** Email [support@ownkube.io](mailto:support@ownkube.io?subject=Feature%20request). Ownkube is shaped by the teams using it and we ship what our users ask for.

## Search

This site has a search endpoint: https://context7.com/api/v2/ask?siteKey=ask_c64dfe8ffaa8d3ad19576838&query=<URL-encoded question>. It returns documentation that answers the question, with a source link for each part. No API key is needed. If nothing matches, it says so.