# HTTPS on every service, custom domains once DNS agrees.

> Every service gets an HTTPS address on `unrent.page` the moment it deploys. Custom domains are routed, and get a Let’s Encrypt certificate, only after DNS shows that the name points at your server and that your organisation owns it.

URL: https://unrent.dev/features/domains/

## A default address for every service

Each service gets `<service>-<env>-<id>.<server>.unrent.page`, served with your server’s wildcard certificate. The certificate is ordered by DNS-01, so default addresses never use up Let’s Encrypt limits.

`unrent.page` is only for your services. Unrent’s own pages live on `unrent.dev`.

## Custom domains, checked before they go live.

- **Ownership:** a TXT record with your organisation’s token, so nobody else can route your name
- **Points here:** every A and AAAA answer is one of the service’s servers (or a CNAME to its default address)
- **CAA:** your CAA records allow Let’s Encrypt
- **Cloudflare proxy:** a proxied record is detected and you are told how to set it up

Apex and `www` can be added as a pair. Checks repeat on their own, and the certificate is requested at the first visit, not before DNS is ready. Certificates that are about to expire raise an alert.

> **Coming:** Cloudflare Tunnel ingress, wildcard custom domains, redirects and public TCP or UDP ports.