Your domains, connected in minutes, with SSL handled for you

Two connection paths, because DNS providers disagree

The standard path is a CNAME: point go.yourbrand.com at our edge hostname and traffic arrives directly at the redirector, with no origin hop in between. This is what most subdomains use, and it is the path the connection wizard recommends by default.

Root domains are the awkward case, because the DNS specification does not allow a CNAME at the apex. Some providers solve it with flattening or ALIAS records — Cloudflare, DNSimple, Namecheap, Porkbun, Google Cloud DNS and several others do, as of August 2026 — while Route 53, GoDaddy and IONOS do not. The wizard reads the nameservers of the domain you entered, works out which camp your provider is in, and shows the instruction that actually applies to it.

When flattening is not available, you get an A record instead: a static ingress IP that terminates TLS on demand and forwards to the same edge. Apex visitors pay one extra network hop of a few tens of milliseconds; in exchange, yourbrand.com works as a link domain with no compromise.

Three records, one of which saves you from future outages

After you submit a hostname, the panel shows the exact records to add, all at once rather than in stages: a TXT record that proves ownership, the CNAME that carries traffic, and a delegation record for certificate validation. That third record is the one people skip and later regret.

Delegated validation means every future certificate renewal is authorised automatically through our zone instead of requiring a fresh DNS change from you. Set it once at connection time and the domain keeps its certificate for as long as it exists. Without it, a renewal eventually needs manual work at the exact moment nobody is watching.

• ✓TXT _cf-custom-hostname.<host> — proves the domain is yours
• ✓CNAME <host> — sends traffic to the edge that serves your links
• ✓CNAME _acme-challenge.<host> — delegates every future renewal
• ✓A <apex> — the issued ingress IP, used instead of the CNAME at the root

Status you can read without asking support

A domain moves through a small, honest set of states. Pending DNS means the records are not visible yet and shows you which ones are missing. Pending SSL means the records were found and the certificate is being issued, which normally takes under ten minutes. Active shows the activation date and a button to open the domain. Error shows the provider reason in plain words plus what to do about it.

You are not required to sit on the page and refresh. A background check re-polls every pending domain once a minute, and a manual Check button is there for the impatient. When a domain goes active, an email goes out and the domain becomes selectable in the link dialog immediately.

Ownership is enforced globally: one hostname belongs to exactly one tenant, and a released hostname is only connectable again after a cooling period. Platform hostnames, and the shared hostnames of deployment providers, are refused outright rather than accepted and then quietly broken.

Domains are the unit of white-label, not a decoration

Link domains and dashboard domains are separate settings with separate purposes. Link domains serve the short URLs. A dashboard domain, such as app.yourbrand.com, serves the product interface your clients log into, so the entire experience — from the address bar to the login screen — stays inside your brand. Out of the box, before you connect anything, the dashboard is already available on your own subdomain of the platform.

Domain allowances come from your plan and are passed down to your clients. A partner plan sets how many redirect domains exist in total, and each client plan you sell sets how many a single client may connect — which is exactly how you package "bring your own domain" as a paid tier of your own service. For comparison, as of August 2026 Rebrandly includes one to ten domains depending on plan and BL.INK starts at one domain for forty-eight dollars a month.