# Add a custom domain

## Problem

You want your app served on your own domain — like `docs.example.com` — instead of the generated `*.lessly.run` URL, with a TLS certificate handled for you.

## UI

1. In `app.lessly.com`, open your service's domain settings and add the hostname (for example, `docs.example.com`).
2. Lessly shows two DNS records: a **CNAME** that points the hostname at Lessly, and a **TXT** that proves you own it.
3. Add both at your DNS provider. Add the CNAME as **DNS-only** — if your provider proxies traffic (for example, Cloudflare's orange cloud), turn the proxy off for this record.
4. Click **Verify**. Lessly checks the records and issues a TLS certificate.
5. When the certificate is active, your app serves on the domain over HTTPS.

## MCP

The same flow through the Lessly MCP server in your agent. Token scope: a key with write access to the app's domains.

Ask in plain language:

> "Add docs.example.com to my app."

Your agent calls [`deployment_domain_add`](/reference/mcp-tools/deployment_domain_add) and returns the **CNAME** and **TXT** records to publish. Add them at your DNS provider (the CNAME as DNS-only), then:

> "Verify docs.example.com."

The agent confirms the records and starts certificate issuance.

## Verify it works

1. The domain reports **verified**, then the certificate moves to **active**.
2. Open `https://docs.example.com` — it serves your app with a valid certificate for that hostname.

Certificate issuance takes a few minutes, and up to ~30 minutes the first time. Until the certificate is active the domain may not answer over HTTPS — that is expected, not a failure.

## Variations

**Migrating a domain that is already live** (for example, behind Cloudflare or another CDN). Add the Lessly CNAME as **DNS-only**, then wait until the hostname resolves to Lessly from a couple of public resolvers **before** you verify. If you verify while the old proxied record is still cached, certificate issuance can stall — validation needs the domain to resolve to Lessly cleanly. Wait for clean resolution, then verify.

**Apex domains.** A bare apex such as `example.com` can't take a CNAME, so Lessly returns **`A` records** for the apex instead — add those and verify the same way as a subdomain. If you'd rather serve on `www.` and forward the apex there, Lessly can also set up an apex → `www` redirect for you.