Domain Connect is an open protocol that lets a service apply DNS changes at a customer's DNS provider after the customer approves them. Nobody copies records by hand. Your customer clicks, reviews a consent screen, and the provider writes the records.

The catch: it only works where the DNS provider supports it. So Domain Connect is one rung of a ladder, not the whole solution. This page covers how it works, which providers give your customers one-click setup through Domainee today, and what we offer for everyone else. For the short definition, see the Domain Connect protocol glossary entry.

Domain Connect in one paragraph

Your customer wants app.theirbrand.com to show your product. Without Domain Connect, they log into a registrar they haven't opened in two years, hunt for the DNS zone, and paste a CNAME. With it, they approve a change on a screen their DNS provider controls.

Who that helps:

Your customer never needs to learn what a CNAME is.
You get a shorter path from "I want my domain" to "it works," and a smaller support queue.

Who it doesn't help: customers whose DNS provider doesn't support the protocol. That's the coverage gap, and it's why you need a fallback.

How Domain Connect works, step by step

Three moving parts: discovery, a template, and the apply step.

Discovery. Find out whether the customer's DNS provider supports the protocol. The discovery record is a _domainconnect TXT record in the zone. This is the part people underestimate. A provider appearing on a list of implementers is not the same as this customer's domain being usable for your service.
Template. The DNS change you want is defined once, as a template. The provider only applies templates it has already synced from the shared Domain-Connect/Templates repository. So your service needs a published, merged and synced template, not just a provider that speaks the protocol.
Apply. The customer approves a consent screen at their provider that lists the records being added. After approval, the provider writes them. The customer approves at their provider, so they never hand your product their DNS login.

Before you build anything, check the details against the public Domain Connect spec. Don't rely on a summary, ours included.

Your app            Customer             DNS provider
   |                    |                     |
   |-- 1. discovery: does this domain support it? -->|
   |<-------------------- yes / no ---------------|
   |                    |                     |
   |-- 2. send customer to consent screen ------->|
   |                    |-- approve change -->|
   |                    |                     |-- 3. write records
   |<------------ records live, verify DNS ------|

The manual flow, for contrast:

Customer logs into a registrar.
Finds the DNS zone.
Adds a record exactly as written.
Waits for propagation.
Emails you when it doesn't work.

Five steps, four places to go wrong. Domain Connect collapses that to one approval.

Which providers support it today

Short list, stated plainly:

Provider	One-click Domain Connect with Domainee
Cloudflare	Yes. Live for all accounts since 2026-09-16 (per our llms.txt).
Glauca Digital	Also listed.
GoDaddy	Not available.

We're not publishing an exhaustive provider list. Lists go stale, and the question your customer cares about is narrower: does my domain support it? Use the free checker below to test any specific domain.

The coverage gap is real. Plenty of customers sit at a provider where the answer is "no." That's not a knock on anyone. It's why the protocol is a rung and not the whole ladder, and why #domains-on-fire tends to start with the customer you can't reach in one click.

Check any domain for Domain Connect support (free)

The free Domain Connect checker takes a domain and tells you whether its DNS provider supports Domain Connect. No account, no key.

There's a public REST endpoint behind it too:

No API key.
30 requests/min and 500 requests/day per IP.
CORS-enabled, so you can call it from a browser.

curl -s "https://api.domainee.dev/v1/tools/domain-connect-checker?domain=example.com" | jq

The response shape is in the Domain Connect checker reference at /docs/free-apis/domain-connect-checker. One thing to read carefully there: supported: true means the provider implements the protocol. It does not mean your service can use it, because your template still has to be synced.

The endpoint is one of 18 free public endpoints. Browser versions are at /free-tools. A related helper, the DNS provider lookup, detects who hosts a domain's DNS. Handy when you want to know who before you decide how.

What to do when Domain Connect isn't available

Here's the fallback ladder, in order:

One-click Domain Connect, where the provider supports it.
A scoped API token, for Cloudflare or DigitalOcean customers. They provide a token, and you apply DNS with a customer token via POST /v1/domains/{id}/dns/apply. The token is used once and never stored.
Provider-specific instructions. GET /v1/domains/{id}/instructions detects the DNS provider from public NS records and returns steps for that provider. See the provider-aware connect instructions endpoint.
The plain CNAME. The baseline. Your customer adds one record wherever they edit DNS.

The CNAME target

The record your customer adds points to edge.domainee.dev. It's visible in DNS. We don't hide it, and you shouldn't promise customers it's invisible.

app.theirbrand.com.  CNAME  edge.domainee.dev.

Apex domains

Subdomains and apex domains are both supported. Where an apex provider disallows a CNAME at the root, we offer two anycast A records instead.

Knowing when setup is done

Don't assume the customer finished. Each domain is re-checked every 5 minutes, or on demand with POST /v1/domains/{id}/check. The monitorStatus field tells you where things stand:

State	What it means in practice
`unknown`	Not checked yet.
`dns_not_resolving`	The record isn't resolving yet. The customer hasn't added it, or it hasn't propagated.
`dns_incorrect`	DNS resolves, but not to the right place.
`pending_ssl`	DNS is right. The certificate is on its way.
`active_ssl`	Done. HTTPS is live.
`ssl_failed`	Certificate issuance failed.
`ssl_expired`	The certificate expired.

SSL is automatic: Let's Encrypt, issued on the first request and renewed automatically. "Not done yet" is a state your product can show, not a mystery.

Build Domain Connect yourself or use an API?

Be honest about the build. If you do it yourself, you own:

Template onboarding: publishing your template and getting it synced at each provider.
Per-provider quirks, forever.
The discovery logic that tells you which domains support the protocol.
A fallback for every domain where discovery says no.

And that's before ACME rate limits, SNI routing and certificate rotation. Domain Connect is one slice of a weekend feature that turns into a quarter.

With Domainee, you create the domain in one API call, and the pieces above are documented endpoints: provider-aware instructions, a scoped-token apply, and one-click Domain Connect for Cloudflare. See Domainee's Domain Connect API for the product page.

One API call to create the domain

curl -X POST https://api.domainee.dev/v1/domains \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"hostname": "app.theirbrand.com", "originUrl": "https://your-app.example.com"}'

The response gives you the CNAME your customer adds, plus status and monitorStatus. The example below is illustrative and trimmed, so check the API reference for the exact shape:

{
  "hostname": "app.theirbrand.com",
  "cname": "edge.domainee.dev",
  "status": "...",
  "monitorStatus": "dns_not_resolving"
}

Auth is Bearer API keys, JSON only. Integration is REST (curl) and the hosted MCP server.

The customer-facing surface

Drop in the embeddable widget: one script tag (https://domainee.dev/widget.js) and Domainee.mount. It polls every 15 seconds and uses short-lived connect-session tokens (default TTL 1 hour, max 24). There's no theming API yet, so plan on the default look for now.

React when setup completes

Webhooks tell your product what happened:

domain.verified
domain.failed
domain.monitor_updated

Each payload is signed with HMAC-SHA256 in the x-domainee-signature header. Delivery gets 6 attempts: immediately, then +1 min, +5 min, +30 min, +2 h and +12 h.

What it costs

Free: up to 20 domains and 100 GB/month, never expires. After the first 20 domains, Scale is $0.20/domain/month. A card on file is required before the first domain, and it's charged $0 under the free tier.

Domainee is by Common Ninja.

Domain Connect FAQ

What is Domain Connect? An open protocol that lets a service apply DNS changes at a customer's DNS provider after the customer approves them.

How does Domain Connect work? Discovery finds out whether the provider supports it. A template defines the DNS change. The customer approves a consent screen at their provider, and the provider writes the records.

Which DNS providers support Domain Connect? Cloudflare is live for one-click setup through Domainee, and Glauca Digital is also listed. Use the free checker to test any specific domain.

Does Cloudflare support Domain Connect? Yes. One-click Domain Connect for Cloudflare has been live for all accounts since 2026-09-16, per our llms.txt.

Does GoDaddy support Domain Connect? GoDaddy is listed as a Domain Connect implementer, but one-click setup through Domainee is not available for GoDaddy. Those customers use the fallback ladder.

How do I check whether a domain supports Domain Connect? Use the free Domain Connect checker, or call the keyless endpoint at https://api.domainee.dev/v1/tools/domain-connect-checker?domain=example.com. Limits are 30 req/min and 500 req/day per IP.

What happens if the customer's DNS provider doesn't support Domain Connect? They get the next rung. Cloudflare and DigitalOcean customers can provide a scoped token, used once and never stored. Everyone else gets provider-specific instructions, then the plain CNAME.

Is Domain Connect safe? Does the service see the customer's DNS credentials? In the consent flow, the customer approves the records at their own provider, so your product doesn't receive their DNS login. With Domainee's scoped-token option, the token is used once and never stored.

Can I use Domain Connect for custom domains in my SaaS? Yes, where the customer's provider supports it. Domainee's Domain Connect API handles Cloudflare today, with fallbacks for everyone else.

Do I need Domain Connect if I already give customers a CNAME? No. A CNAME is the baseline and Domain Connect is optional. It saves your customer the manual steps where their provider supports it. Where an apex provider disallows a CNAME at the root, we offer two anycast A records.

Try it

Test any domain with the free Domain Connect checker, then connect your first custom domain on the free tier: 20 domains, 100 GB, free forever. Sign up at domainee.dev/sign-up.

FAQ

What is Domain Connect?

Domain Connect is an open protocol that lets a service apply DNS changes at a customer's DNS provider after the customer approves them, so nobody copies records by hand.

How does Domain Connect work?

Discovery finds out whether the DNS provider supports the protocol. A template defines the DNS change. The customer approves a consent screen at their provider, and the provider writes the records.

Which DNS providers support Domain Connect?

Through Domainee, one-click setup is live for Cloudflare, and Glauca Digital is also listed. Use the free Domain Connect checker to test any specific domain.

Does Cloudflare support Domain Connect?

Yes. One-click Domain Connect for Cloudflare has been live for all accounts since 2026-09-16, per Domainee's llms.txt.

Does GoDaddy support Domain Connect?

GoDaddy is listed as a Domain Connect implementer, but one-click setup through Domainee is not available for GoDaddy. Those customers use the fallback ladder.

How do I check whether a domain supports Domain Connect?

Use the free Domain Connect checker, or call the keyless endpoint https://api.domainee.dev/v1/tools/domain-connect-checker?domain=example.com. Limits are 30 requests per minute and 500 per day per IP.

What happens if the customer's DNS provider doesn't support Domain Connect?

They get the next rung of the ladder. Cloudflare and DigitalOcean customers can provide a scoped API token that is used once and never stored. Everyone else gets provider-specific instructions, then the plain CNAME.

Is Domain Connect safe? Does the service see the customer's DNS credentials?

In the consent flow, the customer approves the records at their own DNS provider, so your product doesn't receive their DNS login. With Domainee's scoped-token option, the token is used once and never stored.

Can I use Domain Connect for custom domains in my SaaS?

Yes, where the customer's DNS provider supports it. Domainee's Domain Connect API covers Cloudflare today, with provider-specific instructions and a plain CNAME for everyone else.

Do I need Domain Connect if I already give customers a CNAME?

No. A CNAME is the baseline and Domain Connect is optional. It saves your customer the manual steps where their provider supports it. Where an apex provider disallows a CNAME at the root, Domainee offers two anycast A records.