Custom Domains Advanced

Overview

Hostwares supports any custom domain — apex, subdomains, wildcards, and multiple domains per site — with automatic TLS. This guide covers advanced setups beyond the basic Domains & SSL flow.

Apex Domains

An apex (root) domain like example.com cannot use a CNAME at the zone apex per DNS spec. Use one of these instead — Hostwares shows the exact target in Site → Domains after you add the domain.

# Example (Cloudflare, Route 53, etc.)
# Apex via ALIAS
@   ALIAS   cname.hostwares.app

# Apex via A (when ALIAS unavailable — use IPs from dashboard)
@   A       76.76.21.21
@   A       76.76.21.22

# Verify
dig +short example.com
# Should return Hostwares target / IPs

Prefer ALIAS over hard-coded A — IPs can change; the target stays stable.

www & Redirects

Most teams want both example.com and www.example.com to work, with one redirecting to the other.

# Add both domains in Hostwares: Site -> Domains -> Add Domain
# example.com (apex, ALIAS)
# www.example.com (CNAME -> cname.hostwares.app)

# Redirect www -> apex (in your app)
# Middleware / reverse proxy — framework-agnostic
if (req.headers.host === "www.example.com") {
  return Response.redirect("https://example.com" + req.url.pathname, 308);
}

# Next.js example (next.config.js)
async redirects() {
  return [{ source: "/:path*", has: [{ type: "host", value: "www.example.com" }], destination: "https://example.com/:path*", permanent: true }];
}

# Nginx
server {
  server_name www.example.com;
  return 308 https://example.com$request_uri;
}

Pick one canonical host for SEO — example.com or www.example.com — and 308-redirect the other.

Wildcard Domains

Wildcards like *.example.com give every subdomain (acme.example.com,foo.example.com) the same site — ideal for multi-tenant apps. Requires DNS-01 TLS challenge.

1. Add *.example.com in Site → Domains.
2. Create the TXT record Hostwares shows for certificate verification.
3. Add a CNAME for * pointing to the Hostwares target.
4. Wait for TLS to issue (usually under 2 minutes after DNS propagates).

# DNS for wildcard
*   CNAME   cname.hostwares.app
_acme-challenge   TXT   "hostwares-verification=abc123..."

# Verify challenge
dig TXT _acme-challenge.example.com +short

# App: route by subdomain
function getTenant(req) {
  const host = req.headers.host || "";
  const sub = host.split(".")[0];
  if (sub === "www" || sub === "example") return null;
  return sub; // acme, foo, etc.
}

Multi-Domain Routing

One site can serve multiple unrelated domains — useful for white-label or marketing + app setups.

• Add each domain in Site → Domains — each gets its own TLS certificate.
• Route inside your app by inspecting Host header.
• Keep redirects consistent — decide the canonical domain per brand.

# Route by Host header (any framework)
function routeByHost(req) {
  const host = req.headers.host;
  if (host === "example.com" || host === "www.example.com") return "marketing";
  if (host === "app.example.com") return "app";
  if (host.endsWith(".example.com")) return "tenant:" + host.split(".")[0];
  return "default";
}

# Nginx multi-domain -> same upstream
server {
  server_name example.com www.example.com app.example.com *.example.com;
  location / { proxy_pass http://hostwares_upstream; proxy_set_header Host $host; }
}

Cloudflare

Cloudflare works well in front of Hostwares — use it for WAF, edge caching, and DDoS protection.

# DNS when using Cloudflare proxy
# CNAME still points to Hostwares target — Cloudflare proxies to it
app   CNAME   cname.hostwares.app   (Proxied: on)
@     CNAME   cname.hostwares.app   (Proxied: on, flattened)

# Verify end-to-end TLS
curl -I https://app.example.com
# Expect: HTTP/2 200, cf-cache-status header present

# If using Cloudflare Workers / Pages in front, forward Host header intact

Important: with Cloudflare proxied, Hostwares still provisions its own certificate — keep DNS verification TXT records in place. Do not set Cloudflare SSL to Flexible (breaks end-to-end encryption).

SSL Details

• Certificates are issued via Let's Encrypt; wildcard uses DNS-01, others use HTTP-01 or DNS-01.
• Auto-renewal 30 days before expiry — no action needed.
• Need EV or private CA? Upload a custom cert in Domains → Advanced → Custom Certificate.
• HSTS is not set by default — add it in your app once HTTPS is stable (see Security → TLS).

# Check cert from CLI
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -subject

# notBefore=May  1 00:00:00 2026 GMT
# notAfter=Jul 30 23:59:59 2026 GMT
# subject=CN = example.com

Verification & DNS

Hostwares verifies domain ownership before issuing TLS. After adding a domain, create the record shown in the dashboard:

# Check verification record
dig TXT _hostwares-challenge.example.com +short
# Should return: "hostwares-verification=..."

# Check apex/host propagation
dig +short example.com
dig +short www.example.com
dig CNAME app.example.com +short

# Lower TTL before cutover to make rollback fast
# At your DNS provider: set TTL to 60s at least 1 hour before switching

Troubleshooting

# Debug from different resolvers
dig @1.1.1.1 example.com +short
dig @8.8.8.8 example.com +short
dig @9.9.9.9 _acme-challenge.example.com TXT +short

# Test Host header routing without changing DNS (hosts file trick)
curl -H "Host: app.example.com" https://cname.hostwares.app/ -k -I

Still stuck? Check Domains & SSL for the basic flow, or contact support with the domain and dig output.