Project And Service Domains

Domains belong to a project service. Forge verifies ownership and routing before treating a hostname as active.

Add A Custom Domain

Open the correct workspace and project.
Select the web or static service.
Open Domains and choose Add domain.
Enter the complete hostname, such as api.example.com.
Select the intended connected server when Forge asks for a target.
Publish the exact DNS record displayed by Forge.
If you entered records manually, select Refresh & verify after public DNS has propagated. When Forge applied the records through a connected provider, it retries verification automatically.

Do not copy an address from another project or server. The domain panel is authoritative for the record type, host and target required by that service.

DNS Records

Forge normally asks for an IPv4 A record when a service is routed directly to its VPS. A provider may display only the host portion. For example, the host for api.example.com may be entered as api when the DNS zone is already example.com.

Remove conflicting A, AAAA, CNAME or forwarding records before verification. An unexpected IPv6 record can send some visitors to the wrong server even when IPv4 is correct.

When using Cloudflare or another reverse proxy, preserve the proxy mode shown by Forge. A successful edge response does not prove the intended origin is receiving traffic.

Connected DNS Providers

Workspace owners and admins can open Workspace settings → Connections → DNS providers to connect a provider. Forge supports Cloudflare authorization and verified API connections for Namecheap and Spaceship. A connection belongs only to the selected workspace.

After adding a service domain, choose an available workspace DNS connection and select Apply required DNS. Forge shows the exact ownership and routing records before asking for confirmation, checks for conflicts, applies only those records, and verifies the provider result. Reapplying an unchanged plan is a no-op.

The domain then shows two separate results:

DNS applied means the provider accepted and returned the exact required records.
Verified means public DNS resolvers return both the ownership and routing records.

The second result can remain pending briefly because public DNS propagation is separate from the provider write. Forge retries managed-domain verification with bounded backoff for 24 hours and stops when the domain verifies. Refresh & verify performs a separate immediate public check; it does not write DNS records.

Forge does not change nameservers or DNSSEC settings. Remove or resolve a conflicting record yourself, then retry. A DNS connection cannot be disconnected while a domain is still using it.

You can always use the displayed manual records when your provider is not connected or supported. Automated DNS is optional; domain ownership and public routing verification are still required either way.

Generated And Custom Hostnames

Forge may assign a generated hostname to a web service. A custom domain remains attached only to the selected service and project.

Publish only the explicit records Forge generates. Buying a domain does not automatically delegate its DNS to Forge; the authoritative records remain with your DNS provider.

Verification And TLS

Domain verification checks public DNS and the selected service target. TLS becomes ready only after the hostname reaches the intended server and the service can be routed correctly.

If verification is pending:

compare the complete hostname and target with the rows shown by Forge;
check for conflicting or stale records;
confirm the service is healthy on the selected server;
confirm ports 80 and 443 are reachable;
wait for the record’s DNS TTL before retrying.

Forge stops repeated verification after a domain reaches its verified state or after the bounded managed-verification window. A later DNS or routing change can make the domain unhealthy and require verification again.

Database public endpoints have additional authentication and TLS requirements. See Public Access and TLS.