Port Buddy

Custom Domains

With a Pro or Team plan, you can use your own domain name for your tunnels. We handle the SSL certificate issuance and renewal for you automatically.

Setting one up

A custom domain is an alias for one of your Port Buddy subdomains, so the subdomain comes first and your domain is pointed at it.

  1. Open the Domains page and note the subdomain you want to use, for example otter-4821.portbuddy.dev.
  2. Use its Custom Domain action to bind the hostname you own, for example app.mycompany.com.
  3. At your DNS provider, create a CNAME record from your hostname to that subdomain.
  4. Come back and choose Verify CNAME & Issue SSL.
Type    Name              Value
CNAME   app               otter-4821.portbuddy.dev

Most providers ask for just the label (app) rather than the full hostname, and append your zone for you.

Verification and SSL

Verification resolves your hostname's CNAME and compares it with the subdomain you bound. If they do not match, the error names both sides, which usually points straight at a typo or a record created in the wrong zone.

DNS changes are not instant. If verification fails right after you add the record, wait for your provider's TTL to pass and try again — you can check what the world currently sees with:

dig +short CNAME app.mycompany.com

Once the record checks out, a certificate is requested for your domain and renewed for you from then on. The dashboard shows the domain as verified while the certificate is being provisioned, then as active once it is in place.

Things worth knowing

  • A CNAME cannot live at the apex of a zone, so use a subdomain such as app.mycompany.com rather than mycompany.com itself.
  • If your DNS provider proxies traffic (an orange cloud, for instance), turn that off for this record — verification looks for a CNAME and a proxy replaces it with its own addresses.
  • Binding a different hostname clears the verification and the certificate for the old one, so create the new CNAME and verify again.
  • Custom domains apply to HTTP tunnels; TCP and UDP tunnels are reached by host and port instead.

Related

  • A domain can also carry a passcode, so every visitor is challenged before the tunnel is reachable — see private tunnels.
  • To request a fixed portbuddy.dev subdomain instead of your own domain, use the --domain option from the CLI reference.