NS delegation vs Lite
Which onboarding mode to pick, and what each one needs at your registrar.
NS delegation is the full mode. Set the domain's nameservers at your registrar to the ones shown on the domain page. We then serve every DNS answer for the domain: your records, redirects, parking and automatic TLS.
Lite is for domains whose DNS must stay where it is. Point the domain at us from your current DNS host, in this order of preference:
| Type | Name | Value |
|---|---|---|
| CNAME (recommended) | www |
<your team's token>.<our shared nameserver domain>, shown on the domain page |
| ALIAS, ANAME or flattened CNAME | @ |
the same host, where your DNS host supports it |
| A and AAAA | @ |
the ingress addresses shown on the domain page, if your DNS host has no ALIAS |
| TXT (needed with A and AAAA) | _dm |
dm-verify=<your team's token>, shown on the domain page |
A CNAME follows us when our addresses change. A and AAAA records keep the addresses you typed, so they may go stale; the domain page says which one we see ("pointing via CNAME" or "via A/AAAA (may go stale)"). The CNAME's token proves you control the domain, so it needs nothing else. A and AAAA records need the TXT record as well: without it the domain stays pending ("pointing found, ownership not proven"), and an active domain whose TXT is removed stops being served. The TXT on its own does not point the domain at us.
In Lite mode we only serve what reaches our ingress, so DNS records you manage here are not published; services that need DNS records (record sets) apply only to NS-delegated domains.
You can switch a pending domain between the two modes from its setup panel.
Still stuck? Talk to us.