Connect an Apex Domain by IP

An apex domain, also called a bare or root domain, is the name without any prefix: brand.com rather than go.brand.com. Short links look their best there, and it is the natural choice if you bought a domain for links. It needs different DNS records from a subdomain, for a reason worth understanding first.

Why a CNAME cannot live on an apex domain

The DNS standard forbids a CNAME record on a name that already carries other records. Every apex domain carries at least the authority and nameserver records that make the zone work, and usually mail records too. A CNAME on the apex is therefore either rejected by the provider or, worse, accepted and then breaks mail delivery. This is a property of DNS itself, not a limitation of the platform. There are two ways around it.

Option 1: an ALIAS record, if your provider supports one

Some providers implement a non-standard record type — called ALIAS, ANAME or CNAME flattening — that behaves like a CNAME but resolves to addresses before answering, so the standard is not violated. If your provider offers one, use it: the setup is as maintenance-free as a subdomain.

Providers with support include Cloudflare, DNSimple, Namecheap, Porkbun, DNS Made Easy, easyDNS, NS1, Bunny, Azure DNS and Google Cloud DNS. Providers without it include Amazon Route 53, whose alias records only point at AWS resources, plus GoDaddy, IONOS and Network Solutions.

Create the record with your apex domain as the name and cname.linkprofit.com as the target, then follow Connect a Subdomain with CNAME: the verification and certificate records are identical.

Option 2: address records pointing at our ingress

If your provider has no ALIAS record, point the apex at our ingress addresses instead. Traffic reaches dedicated servers that terminate the connection and hand it to the same edge network that serves every other link.

Find your addresses

1. Open Domains and select Connect domain.
2. Enter the apex domain, for example brand.com.
3. Choose the purpose Short links. The panel detects that the name is an apex, checks which provider runs your DNS, and shows the method that will work for you.
4. If address records are needed, the panel lists the exact IPv4 and IPv6 addresses to use, along with a verification token.

Always copy the addresses from the panel: they may change as capacity is added. On the Scale plan you can request a dedicated ingress address used by no one else.

Create the records

A       brand.com                      first address shown in your dashboard
A       brand.com                      second address shown in your dashboard
AAAA    brand.com                      IPv6 address shown in your dashboard
TXT     _linkprofit-verify.brand.com   dom_... token from your dashboard

Two A records are not a mistake: the addresses sit in different data centres, so traffic keeps flowing if one is unavailable. Add the AAAA record too unless your provider cannot store IPv6.

Verification and the certificate

Press Check once the records are saved. We query the TXT record directly and mark the domain verified when the token matches. The certificate is issued the first time a real request arrives, and renewals happen automatically while the domain stays connected.

Until verification succeeds no certificate is issued at all. That is deliberate: it stops anyone from pointing a domain they do not own at our addresses and having a certificate issued for it.

What to expect once it is live

Apex traffic takes one extra network hop compared with a subdomain, adding roughly thirty to sixty milliseconds before the redirect is sent. For most campaigns this is invisible. If your links carry very high volume, put them on a subdomain instead and use the apex to redirect to your website.

Connecting brand.com does not connect www.brand.com; they are separate names in DNS. If you expect people to type the www form, connect it as a second domain following the CNAME guide.

Troubleshooting

Verification never completes. Check the TXT record name for a duplicated domain, such as _linkprofit-verify.brand.com.brand.com. Most panels append the domain automatically, so enter only _linkprofit-verify.

The provider rejects the record. If an ALIAS, CNAME or forwarding rule already exists on the apex, delete it first. Domain parking and "forward to URL" features count as such rules.

Mail stopped working. Address records on the apex do not affect mail, but replacing a zone wholesale does. Confirm your MX and sender authentication records survived the edit.

The domain resolves but returns nothing. The certificate is issued on the first request, so reload once. If it still fails, the status in Domains names the reason.