The worst part of any “connect your domain” flow is the sentence “now log in to your DNS provider and add a CNAME record.” For a non-technical user that is where onboarding goes to die. Domain Connect is the open standard built to delete that step: instead of instructions, the user gets a button that sets the records for them.
It is the protocol Entri's whole pitch leans on, and it is worth understanding whether you buy or build.
The problem it solves
To attach a custom domain to your app, a user normally has to: find their registrar, log in, locate the DNS panel, understand record types, and enter something like:
app.acme.com. CNAME proxy.yourapp.com.Every one of those steps loses people. Domain Connect turns it into: click a link, confirm on your provider's site, done. The records are written for you.
How it works
Two roles and a template:
- Service Provider — you, the SaaS that needs records set. You publish a template describing the records (record type, host, target, TTL) with variables filled in at apply time.
- DNS Provider — the registrar hosting the user's zone (GoDaddy, IONOS, …). It implements Domain Connect and knows how to apply your template.
There are two flavors of the apply flow:
- Synchronous: you redirect the user to a URL at their DNS provider with your template ID and variables; they click confirm; records are written immediately. Simplest, and enough for most SaaS onboarding.
- OAuth (asynchronous): the user authorizes your service once, and you apply changes via API without a redirect each time. More setup, better for ongoing management.
Discovery is DNS-based. To learn whether a domain's provider supports Domain Connect, you look up:
_domainconnect.acme.com. TXT "..."That record points to the provider's Domain Connect API endpoint. No record, or an unsupported provider, means you fall back to manual instructions.
Where it falls short
Honestly, the coverage gap is the catch:
- Partial provider support. Plenty of widely used providers do not implement Domain Connect. You cannot rely on it as your only path.
- Apex is still apex. Domain Connect writes records, but it does not repeal DNS rules — the CNAME-at-apex problem still applies, and the template has to use an appropriate record type for the root.
- Propagation still happens. One-click write does not mean instant global resolution. Verify before you promise the user it is live; a propagation checker helps.
Build vs buy
You can implement Domain Connect yourself: publish templates, do the _domainconnectTXT discovery, build the synchronous apply URL, and maintain the fallback UI. It is a real but bounded amount of work — the ongoing cost is keeping up with provider quirks.
Or you use a service that ships it. The cnames.dev Connect embed does Domain Connect one-click on supported providers, clean copy-paste instructions everywhere else, and live verification in both cases — so you drop in a script instead of building the flow. If you are weighing the commercial options, our Entri alternative comparison lays out the trade-offs, and the full mechanics of custom domains are in the complete guide.