Custom domains
Everything altengine serves publicly is reachable at a subdomain of ours — marketing-web.altengine.app, api-fn.altengine.app, assets-blob.altengine.app. A custom domain puts your own name in front of one of those, with a certificate we obtain and renew.
Domains are managed in the console under Settings → Domains, not per service: one domain points at one instance of Static, Functions or Blob, and can be moved to another later without touching DNS again.
Subdomains only
Register www.example.com, docs.example.com or assets.example.com — not example.com. A root domain needs an A record, and an A record cannot point at a service that answers on many addresses; a root is refused at the point you add it, with the suggestion to use www. and redirect the root to it at your DNS provider, which is one setting at every registrar.
The records to create
Add the domain in the console and it lists the exact records, values included. There are two or three:
| Name | Type | Points at | What it does |
|---|---|---|---|
www.example.com | CNAME | edge.altengine.app | Sends the traffic. This is the one that makes the site load. |
_altengine-verify.www.example.com | TXT | a value unique to your organization | Proves the domain is yours. Everyone's traffic record points at the same target, so without this, a name left pointing at us could be claimed by somebody else. |
_acme-challenge.www.example.com | CNAME | a delegated validation host | Lets the certificate be issued before you move traffic, and renewed afterwards. Shown only when certificate pre-validation is configured. |
Leave all of them in place. The _acme-challenge record is the one people delete once the site is live; removing it makes a later renewal fail rather than anything visible today. The verification record is re-checked when a domain is re-verified or moved.
Set the traffic record to DNS only if your provider offers a proxy (on Cloudflare, the grey cloud). A proxied record hides the CNAME from public DNS, so the check cannot see it and the domain stays pending — the console says so when it detects that specific mistake.
What happens after you add the records
Nothing is registered anywhere until your DNS is actually in place: a mistyped record costs nothing and leaves nothing to clean up. The console re-checks on its own every minute for a freshly added domain, and you can press Check now. Once all the records resolve, the hostname is registered and a certificate is requested; the domain goes active when the certificate is issued, usually in a minute or two.
A domain that never verifies is released after 7 days, and the console says why. Add it again once the records are right.
Moving a domain between instances
A domain is repointed in the console: pick another Static, Functions or Blob instance and save. Traffic follows immediately and the DNS records do not change — they point at the edge, not at the instance. This is what makes a domain safe to move between a site and a function without a propagation wait, and it is why the platform host shown next to a domain is for reference only.
Removing a domain stops serving it. Delete the DNS records too: a record left pointing at us serves nothing, and holding a name you no longer use blocks nobody but you.
Limits
| Limit | Value |
|---|---|
| Domains per organization | 25 |
| Shape | Subdomains only — no root domains |
| Services a domain can point at | Static, Functions, Blob |
| Unverified domain released after | 7 days |
Traffic through a custom domain is billed exactly as it is on the platform hostname — the domain changes the name, not the meter. See pricing for the service it points at.