New — Iris AI drafts your firewall, routing & rate-limit rules. Explore AI features →
Changelog
TunnelsApps

Custom domains behind Cloudflare, including the root of your domain

Add a single hostname, even your bare domain, at any DNS host. Point it to ngris with one record, keep Cloudflare's proxy on, and ngris handles its HTTPS.

Custom domains behind Cloudflare, including the root of your domain

To put your own hostname on ngris, you handed over DNS credentials, or added a wildcard CNAME and uploaded a certificate yourself. A CNAME can't sit at the root of a domain, and Cloudflare's proxy hid the record ngris checked.

Now you can add one hostname at any DNS host: prove you own it with a TXT record, point it to ngris with one record, and ngris gets its HTTPS certificate and renews it. Cloudflare's proxy can stay on. At the root of a domain the record is an ALIAS, which Cloudflare calls a flattened CNAME, with a fixed A record as the fallback, as above.

The New Domain wizard's Setup step: One hostname, automatic HTTPS is selected and marked Recommended, next to Whole domain, automatic and Whole domain, wildcard + upload
Acme Labs wants its storefront on the bare example.com, whose DNS is at Cloudflare. Maya opens Gateway → Domains → New Domain, types example.com and keeps the default, One hostname, automatic HTTPS.
www.example.com is added, with the CNAME record to add for it: www.example.com to cname.ngris.io
After the TXT record, the wizard shows the records above. Maya adds the ALIAS in Cloudflare with the proxy on, then adds www.example.com in one click: the TXT record that proved example.com covers it, so www only needs its CNAME.
The Domains list: example.com, www.example.com and shop.example.com marked One hostname, Active, with valid Let's Encrypt certificates, next to labs.example.com on Route 53
Check DNS in the wizard for example.com, Validate CNAME on the Domains page for www, and both hostnames are Active, each with a certificate of its own. labs.example.com stays a whole domain whose DNS ngris manages through Route 53.

How it works

  • One hostname, automatic HTTPS is the default in New Domain and works with any DNS host. No DNS credentials are needed.
  • Prove it once. Adding several hostnames under one domain? Publish one TXT record for the domain, and every hostname under it is verified by it.
  • The root of a domain. Add an ALIAS to cname.ngris.io (your DNS host may call it ANAME or a flattened CNAME). If it has nothing like it, the fixed A record works too, without our nearest-region routing or failover.
  • Behind Cloudflare. The proxy (orange cloud) can stay on. Full (strict) is recommended, and Flexible isn't supported.
  • Certificates. After Check DNS, ngris gets a certificate for exactly that hostname and renews it before it expires. If the domain has CAA records, they must allow Let's Encrypt.
  • The hostname is the endpoint. Pick it when you create an endpoint, or use it for an app.

Get started

  1. In the dashboard, go to Gateway → Domains and click New Domain.
  2. Enter the hostname or the bare domain, and keep One hostname, automatic HTTPS.
  3. Add the TXT record it shows and click Verify ownership.
  4. Add the record it shows next and click Check DNS.
  5. When the domain shows Active, create an endpoint on it or use it for an app.
  6. Read the docs: One hostname with automatic HTTPS.

Read the docs

Ask an AI to summarise this page
Deploy
App hosting Edge functions Domains & certificates
Connect
Secure tunnels API gateway Multi-region edge
Protect
Bot protection & challenge WAF & firewall Edge login
Observe & AI
Monitoring Inspector & replay Iris AI MCP server AI Gateway
Developers
Developer tools Docs ngrok policy converter Blog Changelog
Compare
Ngris vs ngrok Ngris vs Cloudflare Tunnel Ngris vs Vercel Ngris vs Netlify Expose localhost guide
More
Solutions Pricing Enterprise Sign in Get Started Free