Skip to main content
Every machine already gets name.boxd.sh automatically — see HTTPS. Custom domains let you put your own domain in front of it instead, two ways:
  • Per-machine: point one domain you own at a single machine (app.example.com → myapp).
  • Org-wide (organizations only): delegate a wildcard subdomain to your whole org, so every machine gets its own name under it (myapp.preview.mysaas.com, other-vm.preview.mysaas.com, …) with no per-machine setup.
Both are self-serve. boxd verifies your DNS and issues TLS certificates automatically — no manual cert management, no waiting on us.

​
Per-machine

1

Start adding the domain

This doesn’t touch anything on the server yet — it just prints the two DNS records to add:
The A record’s target is the same shared address myapp.boxd.sh already resolves to — boxd machine get myapp shows it too. The wildcard CNAME is required even if you don’t plan to use subdomains yet; it’s how the certificate gets issued (see below).
2

Add those records at your registrar

Exactly as printed — don’t add anything else, and don’t delegate NS records for this one (that’s the org-wide flow, below).
3

Confirm

Same terminal, same command — it’s paused waiting for you. Once the records are live, press Enter. This is the point where boxd actually starts checking; nothing is created server-side before this.Scripting it instead of running it interactively? Pass -y/--confirm up front and it skips the wait — only do this once the records are actually live:
The domain starts pending and a background check verifies DNS and issues the certificate, typically within a minute or two of the records actually resolving. Once both the apex and wildcard certs exist, it flips to active and starts routing.
Same three verbs from the console’s Domains page, and from the Python and TypeScript SDKs.
Not available on a Tailscale-only org’s machines — the A record lives in your own DNS pointing at boxd’s public proxy, which can’t be repointed at a tailnet address. Org-wide vanity domains (below) don’t have this restriction.
Don’t test the domain before adding the DNS records. Public DNS resolvers cache a “this doesn’t exist” answer once they’ve seen it — sometimes for a while, independent of what the record’s own TTL says once it does exist. If you (or a browser, or a monitoring tool) look up the domain before the records are live, that negative answer can stick around and make a perfectly correct setup look broken for longer than it should. If a domain you just set up won’t resolve for you but boxd’s own check succeeds (console shows active), it’s almost always this — try a different network, or a resolver you haven’t queried it from yet (e.g. explicitly set your browser to use 1.1.1.1 or 8.8.8.8 under “secure DNS” settings).

​
Org-wide (vanity wildcard)

Requires being an org admin. One domain per org — the wildcard covers every machine, current and future, with no per-machine step.
1

Start setting the domain

Prints the NS records to delegate:
2

Delegate at your registrar

This is NS delegation, not an A/CNAME record — you’re handing off DNS authority for preview.mysaas.com itself to boxd, which is what lets it mint a wildcard cert and answer for any subdomain under it automatically. Don’t delegate your whole domain’s apex, just this one subdomain.
3

Confirm

Same terminal, same command — press Enter once delegation is live. For scripts, pass -y/--confirm up front instead:
Once active, every machine in the org is reachable at <machine-name>.preview.mysaas.com in addition to <machine-name>.boxd.sh — the default domain never stops working. The bare vanity domain itself (preview.mysaas.com with no machine name) isn’t routed anywhere; there’s no “default machine” for it.
Same from the console’s Settings page (General tab), and from the Python and TypeScript SDKs (boxd.orgs.set_domain/get_domain/clear_domain). The console’s Domains page links there too, for anyone who lands on the per-machine flow looking for this instead.
Unlike per-machine custom domains, this works on a Tailscale-only org too — boxd-dns is authoritative for the delegated apex (that’s what NS delegation buys you), so it can serve the tailnet address instead of the public proxy IP.