Custom domains: DNS, verification, and SSL

Serving your store from your own domain — shop.yourbrand.com instead of yourname.instore.top — is a plan feature: adding a domain requires the **customDomain** capability, included on higher plans. The platform handles the hard parts (verification checks and SSL issuance); your part is adding two DNS records at your domain provider. This tutorial also explains the one classic failure mode, Cloudflare Error 1001, before you can hit it. ## How to add and verify a domain 1. Go to **Domains** at /dashboard/domains and click **Add domain**. Enter the hostname (a subdomain like **shop.yourbrand.com** is the recommended first domain — it is the most reliable path; root domains work too when DNS is pointed correctly). 2. The platform generates a verification token that looks like **bs-verify-xxxxxxxx...**. 3. At your DNS provider, create a **TXT record** on the host **_birrstore.yourbrand.com** with the token as its value. 4. Back in the dashboard, click **Verify**. The platform resolves your DNS through Cloudflare's DNS-over-HTTPS service and looks for the token. On success the domain is marked verified and, if you made it primary, becomes the address your storefront serves from. 5. Propagation varies by provider — from minutes to an hour or two. If verification fails immediately, wait and retry rather than re-adding the record twice. ## Pointing traffic at the platform 1. Verification proves ownership; a second record routes shoppers. Create a **CNAME** (or an **A record**, if your provider requires it) from your domain to the target the dashboard shows you — with Cloudflare for SaaS active, that is the platform's SaaS target, and it is the only record you need. 2. SSL is automatic: the platform registers your hostname with **Cloudflare for SaaS**, which issues a per-merchant certificate (validation method defaults to TXT, with HTTP and pre-validation supported). The platform re-checks certificate status via the API — you never need to visit Cloudflare or buy a certificate. 3. The dashboard surfaces precise feedback after verification: the certificate status, and a routing note if your traffic record is not yet pointing at the right target. ## The Error 1001 trap If your domain's DNS is on Cloudflare and you point it at a proxied host, Cloudflare-to-Cloudflare resolution fails and browsers show **Error 1001 (DNS resolution error)**. The fix is one of: set your DNS record to **DNS-only (grey cloud)**, or point the record at the platform's SaaS CNAME target instead of a proxied origin host. The domain checker detects this misrouting and tells you directly — a verified domain with a routing note means the TXT record succeeded but traffic still needs the fix. ## What happens next Once verified and routed, your storefront serves from your domain with SSL active, and the marketing-domain branding disappears (your plan's branding settings govern what shows in the footer). You can add further domains, switch which one is primary, or delete entries at any time. ## Plan gating and downgrades 1. **Adding** a domain requires the plan's customDomain flag; the Free plan does not include it by default, and the API returns an upgrade prompt rather than a dead end. 2. If you downgrade later, you can no longer add new domains, but **verifying and managing existing ones keeps working** — you are never locked out of your own DNS. ## FAQ **Why is a subdomain recommended first?** Subdomains avoid the root-domain edge cases (apex records that cannot be CNAMEs, registrar-level proxies) and go live fastest. Start with shop.yourbrand.com; move to the apex once you are comfortable. **Do I need to buy an SSL certificate?** No. With Cloudflare for SaaS, the platform provisions and renews the per-merchant certificate for you. The dashboard shows the certificate status next to each domain. **The TXT record is added but verification fails — now what?** Check the host name (records go on _birrstore.yourbrand.com, not the bare domain), confirm the token is pasted whole, and give DNS time to propagate. The error message distinguishes "record not found" from network failures, so read which one you got.