# Domains and TLS

> Add the domain to a service, create the TXT and A/AAAA (or CNAME) records Unrent shows you, and wait for the checks to pass. The domain then goes live and gets a Let’s Encrypt certificate on its first visit.

URL: https://unrent.dev/docs/domains/

## Records to create

DNS records for a custom domain

| Record | Why |
| --- | --- |
| `TXT _unrent-challenge.<name>` = `unrent-verify=<your organisation’s token>` | Proves your organisation controls the name (for a `www.` name added with its apex, on the apex) |
| `A` / `AAAA` to each of the service’s servers | Points traffic at the servers that run the service |
| or `CNAME` to the service’s `unrent.page` address | An alternative for names that are not an apex |

## Checks and states

A domain is **pending** until ownership, “points here” and CAA all pass, then **verified**, then **active** once each server has applied its routes. Checks run 1, 2 and 5 minutes after you add it, then every 15 minutes while pending and every 6 hours after; **Check now** runs them at once. A domain still pending after 7 days, or failing three re-checks in a row, becomes **failed**.

CAA records must allow `letsencrypt.org` (or not restrict issuers). Every A and AAAA answer must be one of the service’s servers: a stray AAAA record is a common cause of failures.

## Behind Cloudflare

Set the record to **DNS only** until the domain is active, then turn the proxy back on with SSL/TLS mode **Full (strict)**. Unrent detects a proxied record and tells you.

## Default addresses

Every service also gets `<service>-<env>-<id>.<server>.unrent.page`, served with the server’s wildcard certificate. You do not need to configure anything.