Custom domains

Serve your product from your own domain. Add the domain, create the DNS records, and let Orkosi issue and renew the TLS certificate.

Your production environment is always reachable at https://<slug>.orkosi.app. From the Starter plan upward you can also serve it from a domain you own, such as app.acme.com or acme.com. Orkosi handles certificate issuance and renewal; you handle a few DNS records.

Add a domain

1. Open your product hub and go to Domains.
2. Click Add domain and enter the hostname exactly as users will type it: app.acme.com for a subdomain, acme.com for the root of your domain.
3. Choose how DNS will be managed:
   • Keep my DNS — your domain stays with your current provider. You add the records Orkosi shows you.
   • Use Orkosi nameservers — Orkosi hosts the DNS zone for you. You change the nameservers at your registrar once and Orkosi manages every record, including the certificate validation records.
4. Confirm. A one-off domain setup fee is debited from your credit balance; the amount is shown before you confirm.

The domain now appears with the status pending and a table of the records you need to create.

You can do the same through the API:

curl -X POST "https://api.orkosi.com/api/customer-apps/<appId>/domains" \
  -H "Authorization: Bearer $ORKOSI_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domain":"app.acme.com","dns_mode":"external"}'

Use "dns_mode":"route53" for Orkosi-managed nameservers.

CNAME setup

With Keep my DNS, create these records at your DNS provider.

Subdomain (recommended)

Root domain (apex)

DNS does not allow a CNAME at the root of a zone, so the apex needs one of the following:

If your provider offers neither ALIAS nor CNAME flattening, point www at Orkosi and configure a redirect from acme.com to www.acme.com at your registrar. The simplest option is to use Orkosi nameservers, which handle the apex for you.

Orkosi nameservers

With Use Orkosi nameservers, the Domains page shows four nameservers. Replace your registrar's nameservers with those four. Orkosi then creates every record above automatically. Nameserver changes can take up to 48 hours to propagate, although most registrars apply them within an hour.

Warning: Switching nameservers moves your whole zone. If the domain also serves email or other services, recreate those records in Orkosi's zone first, or use Keep my DNS instead.

SSL/TLS

Certificates are issued by AWS Certificate Manager and renewed automatically. Nothing is installed on your side.

1. When you add a domain, Orkosi requests a certificate and receives one or more validation CNAME records.
2. You create those records (or Orkosi does, with managed nameservers).
3. ACM verifies them and issues the certificate. The SSL column moves from pending to provisioning to active.
4. Renewal is automatic for as long as the validation records stay in place. Do not delete them.

Verification and statuses

Orkosi checks pending domains every five minutes and again a few minutes after any change.

A domain serves traffic when Status and SSL are both active and Attach is attached. Until then, https://<slug>.orkosi.app keeps working; the two addresses serve the same production environment.

Troubleshooting DNS

Check what the world sees. From a terminal:

dig +short CNAME app.acme.com          # should print <slug>.orkosi.app.
dig +short CNAME _<token>.app.acme.com # should print the ACM validation target

If dig shows the right values but the status is still pending, wait for the next five-minute check or click Retry.

Common causes of a stuck domain

• The record was created at the wrong level. For app.acme.com the CNAME name is app, not app.acme.com, at most providers. Some providers want the fully qualified name with a trailing dot. Check your provider's convention.
• A proxy is in front of the record. If your DNS provider proxies traffic (for example an "orange cloud" toggle), disable the proxy for the Orkosi records so validation can see the real CNAME.
• An existing A or AAAA record on the same name. A CNAME cannot coexist with other records on the same name. Remove the old records first.
• CAA records. If your zone has CAA records, they must permit amazon.com (and its subdomains) to issue certificates, or the SSL step stays in provisioning.
• Validation record deleted. Removing the ACM validation CNAME after issuance breaks renewal. Recreate it from the Domains page.
• Propagation. Changes at the registrar or nameserver level can take up to 48 hours. Record changes inside an existing zone usually propagate within minutes.
• Status is active but Attach shows awaiting hosting. Your DNS and certificate are correct, and the final binding to your production environment is still completing on the Orkosi side. Contact support@orkosi.com with the domain name if it stays there for more than an hour.

Remove a domain. Use Remove on the Domains page. The hostname is detached and the certificate is left to expire. Removing a domain does not refund the setup fee.