Skip to content

Docs

Domains

Put an app on a hostname you already own, with HTTPS. Tofu proves you own it by a record it reads back, and on Cloudflare one approval replaces copying records by hand.

Agent tools

  • domains
  • domainConnect
  • domainAuthorize
  • domainVerify
  • domainGuidance
  • domainRelease

Connecting a hostname

The two steps are the same in the dashboard’s Domains page and in your agent. Which plans include a domain is on the pricing page.

  1. Claim it

    Claim a hostname you already own in Domains, or with domainConnect: Tofu returns a _tofu.<hostname> TXT challenge and, later, the routing records. A root brings its www with it, and a www its root. On shared static hosting, connect the www address and forward the root to it.

  2. Create the records

    On a domain Cloudflare serves, approve Tofu once on Cloudflare's own screen (domainAuthorize) and Tofu writes those records itself; anywhere else, you create them at your DNS provider. The record of the www or root that comes with it is yours to set either way.

  3. Verify

    Tofu re-reads the challenge over DNS-over-HTTPS, verifies the hostname with the hosting provider and prepares the certificate (domainVerify).

  4. Connected

    The hostname is advertised as connected only after Tofu reads it back and sees the deployment that passed its health check.

A root and its www

Connecting a root such as example.com also brings www.example.com, and connecting www.example.com brings example.com: the other half answers with a permanent redirect (308) to the name you connected. It is not a claim of its own: it needs no _tofu record and does not count toward the ten. A deeper name, such as shop.example.com, brings nothing, and an app on Tofu's shared static hosting connects its www address, with the root forwarding to it: this app cannot use a domain's root.

Its routing record is listed with the connection's own, under its own name, once the hosting provider has it, and you set it at your DNS provider. If the domain company already has a record at that name — often a parking page or a forwarding rule — change that record instead of adding a second one.

The other half never holds the connection back: the name you connected goes live on its own records, and the connection's message says whether the other half sends visitors there yet. If another hosting account holds it, Tofu leaves it there and says so; connect it on its own to move it here. Disconnecting removes it with the connection. Disconnect a name that also has a connection of its own, and your app stops showing there: the other half's connection does not bring it back.

One approval on Cloudflare

Copying DNS records by hand is the step owners actually fail. On a domain Cloudflare serves, you open one link — signed in to Tofu as the account that owns the app — and approve Tofu on Cloudflare's own screen; Tofu then writes the records it had already asked for. The proof of ownership does not move: the _tofu challenge is still read back, so the approval replaces the copy-paste, not the verification. One approval writes one hostname's records, so the record of the www or root that comes with it stays yours to set.

The approval is offered only for a zone Cloudflare actually serves: Tofu reads the zone's nameservers first, and a zone served by somebody else gets that provider's name and the record instructions instead of a button.

There is no field for an API key or a token anywhere: an approval is a link you open on the provider's own screen, and Tofu can withdraw it (domainAuthorizationRevoke, the Domains page's Stop Tofu adding settings).

Anywhere else

You create the records at your DNS provider, and Tofu shows exactly which. The Domains page — and domainGuidance for your agent — also reads the DNS you are about to change: who serves the zone, the steps for that provider, and any existing record that would fight the one Tofu asks for. That read writes nothing.

Propagation takes minutes. Verifying again later reports the state as it is, rather than a connection that has not happened.

What each state means

StateWhat it means
ownership_pendingThe _tofu TXT record is missing or has not propagated yet.
dns_pendingOwnership is proven; the routing records are still pending.
certificate_pendingHTTPS is being prepared.
connectedRead back, and serving the deployment that passed its health check.
disconnectingThe connection is being removed.
errorThe row carries the explanation.

Rules

  • Each proven hostname is unique across all Tofu projects, and a project may claim at most ten; the www or root that comes with one is not counted. A hostname connects only to the app that published it.
  • A connected domain does not replace the app's managed address.
  • domainRelease, the dashboard's Disconnect, withdraws any approval Tofu holds and removes the connection, with the www or root that came with it. Your registration and the records you created stay with your provider.
  • Sending sign-up email from your domain uses its own records, all under send. — see Sign-in & email.

What Tofu does not do with domains

  • Sell them. Buying a domain through Tofu isn't open yet. You can buy, renew and transfer a domain at your registrar, then connect it to your app here.

  • Write DNS without your approval. Records are written only through the approval you gave on Cloudflare’s own screen, one hostname’s at a time; everywhere else, and for the www or root that comes with a connection, they are yours to create.

  • Take a credential. No form, tool or message accepts a DNS API key, token or password.