Custom Domains for Short Links: The Complete Setup Guide

A short link is a promise about where a click will land, and the domain is the only part of that promise a person can read before deciding. A string like bit.ly/3xKqR2p says nothing about who is asking; go.yourbrand.com/spring-sale says both who and what. That gap is why most serious link programs eventually move off a shared domain, and why the move so often stalls halfway: it is a DNS project wearing marketing clothes, and the failure modes are unfamiliar to the people who asked for it.

This guide covers the whole path. Choosing a domain, the exact records for subdomains and for apex domains, how ownership verification and certificate issuance actually work, the handful of DNS mistakes that account for most broken setups, and how to verify a finished redirect chain before you print it on packaging you cannot recall.

Why the Domain on a Short Link Matters

Recognition happens before the click

Every link is a small trust decision made in about a second. On a shared shortener domain the reader has no information at all: the hostname belongs to a service used by millions of people, some of them running phishing campaigns that week. A branded hostname replaces the guess with a fact.

Vendors publish click-through uplift figures for branded links; treat them as directional, since the comparisons are rarely like for like. The mechanism is the durable part: in channels where the URL is visible and unclickable, printed material, QR captions, SMS with previews stripped, the hostname is most of what the reader has to go on.

Shared domains carry other people's reputation

This is the sharper argument. On a shared domain your links inherit a reputation you do not control. Email filters, corporate proxies, messenger link scanners and browser safety programs make decisions at hostname granularity, so a spam wave from unrelated accounts on the same domain lands on your campaign as a warning interstitial or a silent block.

A domain you own inverts the relationship. The reputation is yours, built by your own traffic, and it cannot be damaged by strangers. The obligation is the mirror image: you now own the consequences of everything published under it, which is a reason to keep abuse controls and per-user link visibility in mind if you resell links to other people.

Ownership is what makes migration possible

A domain you control is a permanent address: change platforms and you repoint a record, while the codes on last quarter's packaging keep resolving. Publish on a vendor's shared domain and every printed asset is hostage to that vendor's pricing. This is the same reasoning that drives the white-label model.

Choosing the Domain

Length is the entire point

A short link exists to be short. Every character in the hostname is a character not available to the slug, and hostname characters are the ones people read aloud, type from a poster, or squeeze into an SMS. A useful target is a total link length that fits comfortably in a printed line: roughly ten to fifteen characters of hostname plus a slug of five to twelve.

| Pattern | Example | Best for | Trade-off | | --- | --- | --- | --- | | Subdomain of your main domain | go.yourbrand.com | Fast launch, owned channels, email | Longest of the three | | Shortened brand on a short TLD | yrbrnd.co | SMS, print, packaging | Needs a new registration, less obvious | | Full brand on a themed TLD | yourbrand.link | Campaign hubs, QR codes | Apex setup, TLD reputation varies |

TLD choice has practical consequences

Not all top-level domains are treated equally by filters. Cheap and promotional TLDs carry high spam density, which some corporate mail gateways handle bluntly. Country-code TLDs used as word endings, the family that gives us .co, .io, .to and .ly, answer to registries with their own policies and renewal costs. Before registering, check the renewal price rather than the first-year price, any registrant restrictions, and whether the channels you publish in auto-link the suffix at all.

How many domains you get is a real limit

Domain allowances differ sharply between vendors, and they bite as soon as you run more than one brand or client. As of August 2026, Short.io includes five custom domains even on its free tier; Rebrandly allows one, two, three and ten across its paid tiers; BL.INK starts at 48 USD per month for one user and one domain. LinkProfit includes three redirect domains on Starter at 49 USD per month and thirty on Scale. If you manage links for clients, count the domains you will need in a year, not this month.

Certificate coverage is worth checking in the same pass. Cutt.ly, as of August 2026, provides automatic Let's Encrypt certificates only from its Single plan at 25 USD per month, which means a custom domain on the tiers below it is not fully usable over HTTPS. The full feature comparison lives on our custom domains page.

The DNS Records You Actually Create

Three records cover almost every setup: one that routes traffic, one that proves ownership, and one that delegates certificate validation. Which routing record you use depends on whether you chose a subdomain or an apex.

A CNAME for a subdomain

This is the common path and the one to prefer. The subdomain points at a hostname owned by the platform, and the platform's edge network answers for it.

Type   Name   Value                   TTL    Proxy
CNAME  go     cname.linkprofit.com    300    DNS only

Two details trip people up. Most DNS panels want the name relative to the zone, so go rather than go.yourbrand.com, but a few require the fully qualified form, and entering the wrong one silently creates go.yourbrand.com.yourbrand.com. And if your DNS is hosted at Cloudflare, the record must stay unproxied, which the panel calls DNS only; the reason is in the mistakes section below. Vendor targets differ but the shape does not: Short.io uses cname.short.io and Rebrandly uses registrar.dedicated.domains, as of August 2026. Step-by-step screenshots for the popular registrars are in the CNAME setup documentation.

An A record for an apex domain

DNS forbids a CNAME at the apex of a zone, because the apex must also carry SOA and NS records and a CNAME cannot coexist with other records at the same name. So yourbrand.link itself cannot be a CNAME. Two ways out.

The first is provider-side flattening, sold as ALIAS, ANAME or CNAME flattening, where the DNS provider resolves the target and answers with its addresses. Cloudflare, DNSimple, Namecheap, Porkbun, DNS Made Easy, easyDNS, NS1, Bunny, Azure DNS and Google Cloud DNS support it. Route 53, GoDaddy, IONOS and Network Solutions do not offer it for targets outside their own ecosystems.

The second is an A record pointing at an ingress IP address the platform issues to you. The addresses below are placeholders in the documentation range; use the values your dashboard shows.

Type  Name  Value              TTL
A     @     203.0.113.10       300
AAAA  @     2001:db8::10       300
CNAME www   cname.linkprofit.com  300

Add the www record even if you never publish www links: people type it out of habit, and an unanswered www produces a connection error rather than a redirect. Apex specifics, including which providers show which label for the apex record, are covered in the apex domain documentation. Vendors publish these addresses openly, and as of August 2026 Short.io documents 207.174.61.1 while Rebrandly documents 52.72.49.79, which is a useful sanity check that this path is standard rather than exotic.

A TXT record proving the domain is yours

Without proof of ownership, anyone could claim go.yourbrand.com on a shared platform and receive traffic meant for you the moment you created the CNAME. Platforms therefore issue a token and check it before serving.

Type  Name                 Value
TXT   _linkprofit-verify   dom_2f7a91c4be0d3856

The token is unique to your domain record. Once the hostname is active the record can stay in place; removing it does not break a live domain, but leaving it avoids surprises during re-validation.

Automatic TLS Without a Renewal Treadmill

How the certificate is issued

Your platform needs a certificate valid for a hostname it does not own. That is exactly what ACME, the protocol behind Let's Encrypt, was built to automate: the platform requests a certificate for go.yourbrand.com, the certificate authority issues a challenge, and the platform proves control by answering it. Domain validated certificates are issued in seconds once the challenge passes, and they cost nothing.

The important property is lifetime. Modern certificates are short-lived by design, so issuance is not a setup step that ends. It is a renewal loop running for as long as the domain is connected, across every domain in the system.

Delegating the challenge once

The robust way to make that loop invisible is to delegate validation. You create one CNAME on the challenge name, pointing at a delegation target the platform controls, and from then on every renewal is answered by the platform without any action from you.

Type   Name                 Value
CNAME  _acme-challenge.go   the delegation target shown in your dashboard

The alternative, pasting a fresh TXT value every renewal cycle, works exactly until the person who owns that calendar reminder changes jobs. If a vendor's setup flow requires recurring manual validation, treat it as a known future outage rather than an inconvenience.

What a healthy provisioning flow looks like

Expect three visible states and automatic movement between them: pending DNS while the records are not yet observable, pending certificate once they are, and active when traffic can be served. Rechecks should run on a schedule of about a minute rather than only when you click a button, and the interface should tell you which specific record is missing rather than reporting a generic failure. Typical end to end time on a clean zone with a low TTL is a few minutes.

DNS Mistakes That Break Live Links

Proxying the record and the Flexible mode loop

The single most common failure on Cloudflare-hosted zones. Turning on the orange cloud puts a second TLS terminator in front of a platform that already terminates TLS for that hostname. With encryption set to Flexible, the proxy connects to the origin over plain HTTP, the origin answers with a redirect to HTTPS, the proxy forwards that back, and the browser loops until it gives up. Rebrandly documents this conflict for its own users; it is a property of the configuration, not of any one vendor. Keep the record unproxied unless you have a specific reason not to, and if you must proxy, set encryption to Full strict.

Leftover and conflicting records

A subdomain that once pointed somewhere else usually still has an A record, and a name cannot hold both a CNAME and other record types. Some panels reject the second record with a clear error, others accept it and produce intermittent resolution. Before adding anything, list every existing record for that exact name and delete what is stale. Watch for wildcard records too: a * entry in the zone will answer for go if no explicit record exists, which makes a missing CNAME look like a working one.

CAA records that exclude the issuer

If your zone publishes CAA records, they restrict which certificate authorities may issue for it. A zone locked to one commercial CA will silently block Let's Encrypt issuance, and the failure surfaces as a certificate that never appears. Either add the issuer your platform uses or remove the restriction for the hostname in question.

High TTL set just before a change

TTL is the promise you made to resolvers about how long the old answer stays valid. Change a record with a TTL of 86400 and some resolvers keep the previous value for a day. Lower the TTL to 300 at least a day before a planned cutover, then raise it again once the new setup is verified.

Registrar parking and forwarding

Newly registered domains often arrive with parking pages, URL forwarding, or a registrar's default records already in place. Forwarding in particular interferes in a way that looks like a platform bug, because the registrar answers the request before it ever reaches your redirect engine. Turn it off explicitly rather than assuming a new domain is empty.

Verifying the Chain Before You Print It

Resolution and redirection are separate questions, so check both.

dig +short go.yourbrand.com CNAME
dig +short go.yourbrand.com A
curl -sSI https://go.yourbrand.com/spring-sale | grep -i -E 'HTTP/|location'

The curl output should show a single redirect status followed by one location header pointing straight at the final destination. Two things to look for. First, hop count: each additional hop adds a round trip and dilutes referrer data, so a chain that passes through a tracking domain before reaching the destination should be collapsed. Second, the destination URL should be exactly what you configured, including UTM parameters, since a destination that itself redirects, from http to https, or from apex to www, adds a hop you did not intend.

Run the same check on the apex and the www form, over both http and https, and once with a mobile user agent if the destination does device-based routing. For a quick check without a terminal, our link checker expands the full chain and shows each status code, which is also the fastest way to inspect a competitor's or partner's link before you republish it. Finally, click one of your own links and confirm the event appears in analytics: a domain that resolves and redirects but records nothing usually means traffic is reaching a different origin than you think.

The Setup Sequence, Start to Finish

1. Register or select the domain, and confirm the renewal price and registry restrictions.
2. Lower the TTL on any record you are about to replace, ideally a day ahead.
3. Add the domain in your link platform and copy the exact records it displays.
4. Create the routing record: CNAME for a subdomain, A and AAAA for an apex without flattening.
5. Create the ownership TXT record and the delegated challenge CNAME.
6. If your DNS is at Cloudflare, confirm the routing record is unproxied.
7. Delete stale records for the same name and check for a wildcard that could shadow it.
8. Wait for the status to move through pending certificate to active, then verify with dig and curl.
9. Test apex, www, http and https, plus one mobile user agent.
10. Create a canonical link, click it, and confirm the click is recorded.
11. Raise the TTL again and document who owns the domain renewal.

Most of this is a fifteen minute job on a clean zone. The exceptions are apex domains on providers without flattening, which need the IP path, and zones with years of accumulated records, where the work is deletion rather than addition.

A branded domain is the cheapest credibility upgrade available to a link program, and once it is connected the rest of the stack runs on infrastructure you already control. If you are setting domains up for clients rather than yourself, per-client domains are what makes the offer credible: see custom domains for how allowances work across plans.