Custom domains, DNS and HTTPS for your first product

Buying a domain takes two minutes. Getting your product to load on it, with a padlock, without breaking your email, is where people lose an evening. Most of the confusion comes from DNS: a system with a handful of record types, each doing one job, and a delay that makes every change feel like it didn't work.

This guide walks through the whole path once, in the order you'll do it.

Choosing a domain

• Short and spellable. You'll say it out loud on calls. If you have to spell it, it's too clever.
• A .com if you can, especially for a US audience. Other endings work, but people type .com by habit.
• Not your product's feature. "receiptreminders.com" boxes you in. A name you can grow into lasts longer.
• Check the renewal price, not just the first-year price. Some registrars discount year one heavily.
• Turn on auto-renew the day you buy. Losing a domain to a missed renewal email is a painful, common mistake.

Apex or www?

The apex (or root) is yourproduct.com. The www version is www.yourproduct.com. Visitors will type both, so both need to work, and one should redirect to the other so search engines see a single site.

Either is fine. Pick one, set it as the main domain in your host, and let it redirect the other.

The records you'll actually touch

Two ways to connect a domain to your host

Keep DNS where it is

Your registrar (or a DNS provider you already use) keeps managing everything. You add the one or two records your host asks for. This is the least disruptive option if you already have email and other services on the domain.

Move DNS to your host

You change your domain's nameservers to your host's, and manage records there. It's tidier, and some features only work this way. On Netlify, using Netlify DNS gets you an automatic wildcard certificate, so every Netlify site on a subdomain of your domain gets HTTPS instantly^[1]. The cost is moving every existing record, including email ones, before you switch.

HTTPS without thinking about it

A padlock in the address bar isn't optional anymore: browsers warn visitors away from sites without it, and payment and login flows need it. The good news is that most modern hosts handle it for you.

On Netlify, every site is secured on its generated address immediately, and when you add a custom domain, a Let's Encrypt certificate is provisioned and renewed automatically^[1]. Two catches from Netlify's documentation:

• The domain's DNS must actually point at Netlify. It can't issue certificates for subdomains whose content is hosted elsewhere^[1].
• Domain aliases need their DNS set up before you add them, so they're included on the certificate^[1].

If you bring your own certificate instead, renewal isn't automatic: you renew with your certificate authority and reinstall it yourself^[1]. For a small product, the managed certificate is the right default.

Why it seems not to work (yet)

DNS records are cached. When you change one, the old answer can stay in caches around the world until its time-to-live (TTL) runs out. That's why a change can work on your phone but not your laptop, or work for you but not a friend.

Set up email on the same domain

Your product will send email from this domain too: sign-in links, receipts, reminders. Use a sending subdomain such as mail.yourproduct.com, and add SPF, DKIM and DMARC records. Gmail requires all senders to authenticate with SPF or DKIM, and bulk senders to use both plus DMARC^[3]. The full walkthrough is in Why your emails land in spam.

The whole thing, in order

1. Buy the domain, turn on auto-renew and two-factor login at the registrar.
2. Add the domain in your hosting dashboard and choose apex or www as main.
3. Add the records your host asks for (or move nameservers, copying every record first).
4. Wait for the certificate to be issued; check the padlock on both apex and www.
5. Set up your sending subdomain and email authentication records.
6. Test sign-up end to end on the real domain before inviting anyone.

A real setup, start to finish

Hypothetical example

Product site on Netlify, existing email with a separate inbox provider, DNS staying at the registrar:

Five records cover the website, your inbox and your product's email. Everything else on the domain stays as it was.

DNS slips that cost an afternoon

• Moving nameservers without copying MX records. Your inbox stops receiving mail.
• Two versions of the site live (apex and www) without a redirect. Search engines see duplicates.
• Letting the domain expire because the renewal email went to an old address.
• Changing DNS on launch morning. Do it days before, so caches have caught up.

Questions

Put your product on its real domain at least a week before launch, so DNS caches settle and you can test sign-up exactly as customers will. Then follow the launch week plan.