Your own domain on Brewless, without moving your DNS

Moving an app is enough work without moving its DNS too. Many domains have their zone at the registrar or at a DNS provider the rest of the company depends on, with mail, verification records and other sites in it. With Brewless that zone can stay where it is. This post shows what you make there, what Brewless does by itself, and what happens when something changes later.

Can I use my own domain on Brewless without moving my nameservers?#

Yes. When the zone of your domain is not at Bunny DNS or Scaleway DNS in your own accounts, Brewless shows the one record the name needs, and you make it at your own DNS provider. Brewless then looks that record up by itself and issues the certificate as soon as it points the right way. Your nameservers, and every other record in the zone, stay as they are.

When the zone is at Bunny DNS or Scaleway DNS in the accounts you connected, Brewless makes the record itself; see Moving your domain to Brewless.

Add the domain#

brewless domain:add production shop.example.eu

Adding the domain does not wait for the record. It ends with what to make:

WARN  The DNS of shop.example.eu is kept where Brewless does not reach. Make this record at your DNS provider:

    CNAME  shop.example.eu  ->  acme-shop-production.b-cdn.net

  Brewless looks it up every few minutes and issues the certificate by itself once it points the right way.

The console shows the same under Domains on the environment's Resources page, with a copy button on each value. The domain is now Waiting for DNS.

Tip

Some DNS providers add your domain to the name by themselves. Then enter only the part before it: shop for shop.example.eu.

What Brewless does while it waits#

A lookup is a question to the public DNS. It never reaches your application, so it wakes none of your containers. Did Brewless stop waiting? Make the record and press Check now at the domain, or run brewless domain:check production shop.example.eu, and the wait starts again. Check now works once a minute per domain.

With bunny.net in front, the name is on the pull zone from the start and only the certificate waits. Without bunny.net the name goes straight on the Scaleway container, and Brewless attaches it only once the record points there: Scaleway looks a name up the moment it is attached, and remembers a miss for up to an hour.

The domain itself, without www#

A CNAME may not stand on the domain of a zone itself, such as example.eu. For that name Brewless asks for an ALIAS, and the console names three ways to get there:

• Your DNS provider offers ALIAS, ANAME or CNAME flattening. Make that record, pointing to the target Brewless shows.
• Your registrar forwards example.eu to www.example.eu. Add www.example.eu to the environment instead, with a CNAME.
• Move only this zone to Bunny DNS in your bunny.net account. Brewless then makes the record itself.

An ALIAS answers with addresses, and they need not be the ones Brewless gets for the target, so a lookup cannot always see that it points the right way. Brewless then asks bunny.net for the certificate, and an issued certificate is the proof. It does that at most once an hour, because Let's Encrypt allows only a few failed tries per name an hour.

After it is live#

Brewless looks the record of a live domain up once a day.

• The record no longer points at the environment. Somebody changed it, or a new site took the name. The domain shows DNS changed, and the owners get a mail with the record that belongs there. Once it is back, the next look sees it.
• The environment answers on a new address. Without bunny.net in front, a web container made anew gets a new address from Scaleway. The console shows the new record, a mail says which, and you change it at your provider.

Note

Brewless never changes a record at your own DNS provider. It says what the record has to be and what it found, and the change is yours. Every step is in the audit trail.

Every record you keep yourself, in one place#

The DNS page of the console has a card Records you keep yourself. It lists every domain whose DNS is at a provider of your own, for every environment, with its state and what the last lookup found. It also lists the mail records (SPF, DKIM and DMARC) of a sending domain whose zone is kept there, each marked In place or To make.

From the command line, brewless domain:list does the same for one environment:

brewless domain:list production

Coming from Laravel Vapor#

At Vapor, a domain outside Route 53 meant copying records from vapor record:list into your registrar. The idea is the same here: brewless domain:list shows the records, and the certificate follows once they point the right way. The difference is that Brewless keeps looking, says when a record goes missing later, and never needs AWS for any of it. The rest of the move is in From Laravel Vapor to European infrastructure, and the details are in Domains.