CloudJod

Domains and DNS

Connect app domains to one CloudJod edge across servers and providers, with ownership verification and HTTPS.

One edge for every provider

Your application hostname points to CloudJod's edge. The edge terminates HTTPS and routes requests to healthy app replicas. An attached server connects back over an encrypted WireGuard tunnel, so its public IP and its provider's DNS records are separate from your application's public address.

For example, web.my-team.cloudjod.com keeps working when its replicas move between connected servers. Your VPS hostname, reverse DNS and provider nameservers do not need to be combined or changed.

Connect a custom domain

  1. Open Resources → Domains & DNS. Choose a public app and add a hostname such as app.example.com.
  2. At the domain's current DNS provider, add the TXT record shown under Prove ownership. A connected supported DNS account can publish this ownership record automatically.
  3. Add the CNAME shown under Route traffic to CloudJod. Its destination is the app's CloudJod hostname, rather than a workload VPS's IP address.
  4. Choose Check ownership, then refresh after DNS has propagated. CloudJod serves the custom hostname only after ownership verification. HTTPS certificate issuance also requires that traffic reaches the edge.

For a root domain such as example.com, use your DNS provider's ALIAS/ANAME or CNAME flattening if available. Otherwise obtain the edge's supported A/AAAA addresses from the platform operator. Do not create a standard CNAME at the zone apex alongside its SOA/NS records.

If you publish an AAAA record, the edge must be reachable over IPv6 as well as IPv4. Remove outdated records that send some clients to an old server. DNS propagation follows the previous records' TTLs.

DNS accounts

The DNS connections section supports Hetzner's current Cloud API. Use a token created in Hetzner Console for the project holding your primary zones. The old DNS Console API and its tokens are unsupported. A dedicated project narrows the token's reach; a Cloud API token is not inherently restricted to DNS.

Only organization owners can connect, rotate or disconnect provider credentials. Credentials are stored encrypted and never returned by the API or delivered to attached servers. Automatic publishing writes the dedicated ownership TXT record. Add traffic records at your provider; CloudJod does not transfer your registrar or operate a public authoritative nameserver service.

Security and availability

CloudJod checks domain ownership before routing or requesting a custom-domain certificate. Keep domain registration and DNS-provider accounts protected with MFA. Remove a custom domain from CloudJod when you no longer control it, and remove old DNS pointers when retiring an app.

Adding compute servers distributes workloads. Edge redundancy, database availability, backups and volume replication are separate requirements. Moving a stateless app does not copy data stored on another server's disk. The installation operator must configure and test edge failover and offsite recovery for the required availability.

See Your own servers for placement and tunnels, and Security for account and workload protections.

Next: Teams and access