Settings → Domains: type the hostname, Add, create the rows listed under DNS records at your DNS provider, then Refresh status until the badge reads Active. The certificate issues itself at the edge, and the .kad.dev host keeps working alongside.
The DNS rows
The screen labels each row by purpose and gives a copy button per value. Which rows appear depends on the domain, so copy what your screen shows, not what this table lists.
| Purpose | Type | Required |
|---|---|---|
| Route traffic | CNAME to the target shown | yes |
| Prove ownership | as shown | yes, when requested |
| Automate TLS | CNAME on _acme-challenge. plus your hostname |
recommended |
| Validate TLS | TXT and CNAME, one pair per record requested | yes |
The one trap: your hostname's CNAME points at the routing target, never at an _acme-challenge name. Those are two different rows.
One exact hostname
www.example.com works. example.com is refused with a hint to use a subdomain, and so is *.example.com. To land the bare domain on your app, redirect it to www at your DNS provider; that is DNS practice, not a kad.dev feature, and not every provider offers it. A .kad.dev hostname cannot be attached as a custom domain.
Status
The badge goes Pending DNS, Pending SSL, Active. Failed means the hostname was rejected or validation timed out; when there are diagnostics, they sit at the bottom of the DNS records disclosure.
Which commit it serves
The canonical one, the same as the bare your-app.kad.dev; promote another commit and the domain follows (commit URLs). Per-commit URLs stay on .kad.dev.
Custom domains are always public, so the form refuses one until the canonical deploy is public: set new commits to Public in Settings → Deploy → Access, or Make public on the canonical commit. A project with Google sign-in turned on is refused as well.
Removing
Removing a domain here does not touch your DNS: delete the rows at your provider yourself. Deleting the project removes its domains with it.
Limits
- No apex, no wildcard.
- Not over MCP: an agent deploys the app, the dashboard attaches the domain.
- No uploading your own certificate.
- No Google sign-in gate on a custom domain.