NFLTR›Docs›Guides

Serve Your Site on Your Own Domain

An agent that serves a site with nfltr up (an http: service) can answer on a domain you own instead of a ….nfltr.xyz address. You prove the domain is yours with a TXT record, point it at nfltr, and nfltr gets and renews its certificate.

Custom domains are available on nfltr.xyz from v2.1.53.

Before you start

1. Add the domain

Dashboard, Account, Custom domains: type the domain (www.example.com), pick the agent that serves it and, when the agent serves named services, one of its http services (an add without one is refused and names them). Add domain. The agent and service are fixed once added: to point the domain elsewhere, remove it and add it again (with a new TXT record).

The domain then shows its DNS records under DNS records.

2. Prove it is yours: the TXT record

type name value
TXT _nfltr-challenge.www.example.com nfltr-verify=<token>

Copy the value from your dashboard: the token is your account's for this domain. Many providers ask only for the part of the name before your zone (_nfltr-challenge.www in the zone example.com).

Keep this record. nfltr reads it again every 6 hours. When it is missing on three checks in a row spanning at least 12 hours, the domain lapses: nfltr stops serving it and you get a notice. A check that cannot reach DNS at all does not count as missing.

3. Point the name at nfltr

A subdomain (www.example.com, app.example.com): one CNAME record.

type name value
CNAME www.example.com domains.nfltr.xyz.

The trailing dot is optional in most providers' forms.

A name that cannot take a CNAME: the apex of your zone (example.com, example.co.uk), or a name that already has other records of its own (MX, TXT, ...; the _nfltr-challenge record is a different name and does not count). Use either

The dashboard shows both for a two-part name like example.com, and the apex records under "Is this name the apex of your zone?" for a longer one like example.co.uk.

4. Statuses and what to do

status meaning what to do
Pending the TXT record has not been seen yet add it, wait a few minutes, Check now; a domain still pending 7 days after it was added (or last checked) is removed, and you can add it again
Failed the last check failed; the dashboard says why see the reasons below
Not pointed here verified, but the name does not point at nfltr yet; no certificate is ordered add the CNAME, or the apex records, from step 3
Issuing certificate verified and pointed here; the certificate is being issued wait a few minutes; the name answers a TLS error until it is done
Active served over https; the dashboard shows the certificate's expiry nothing; it renews on its own about 30 days before expiry

Why a check failed:

reason what to do
TXT record not found add the record exactly as shown; new records can take a while to show at every DNS server; Check now later
another account's record is still there another account's _nfltr-challenge record is still on this name: remove it at your DNS provider, then Check now
lookup failed DNS did not answer; nothing changed; Check now again in a few minutes
raced another change to this domain landed at the same moment; Check now again
too many checks at most 10 checks per domain per hour; try again later

When a certificate order fails, the dashboard says why in a sentence: the certificate authority's reason (for example a CAA record that does not allow Let's Encrypt, or a name that does not point at nfltr), or that your account has ordered as many certificates as it may in one day, in which case the next order is tried within the hour. nfltr retries on its own. On an active domain, "Renewal is failing" means the current certificate still works and nfltr keeps retrying; check that the name still points at nfltr.

5. Check now

Check now reads the TXT record at once instead of waiting for the next periodic check. Use it after adding or fixing a record.

6. Remove a domain

Remove (it asks first) stops serving the domain at once and deletes its certificate. Delete its DNS records at your provider afterwards. You can add the domain again later.

Move a domain to another account

  1. Remove the old account's _nfltr-challenge record at your DNS provider (or remove the domain in the old account's dashboard and then delete the record).
  2. In the new account, add the domain and publish its own _nfltr-challenge record.
  3. Check now in the new account.

While the old account's record is still in DNS, the new account's check fails with "another account's record is still there": a domain moves only once its current holder's record is gone. When it moves, the old account gets a notice and stops serving it.

Limits