# Your own domain on Brewless, without moving your DNS

Keep your nameservers where they are: Brewless shows the record to make at your own DNS provider, looks it up by itself and issues the certificate.

## In short

- A domain whose DNS is at a provider of your own works on Brewless without moving its nameservers; you make one record there yourself.
- Brewless shows that record, looks it up in the public DNS every 5 minutes for 3 hours and then every hour, and issues the certificate once it points the right way.
- After 36 hours without the record Brewless stops looking and says so by mail; Check now in the console, or brewless domain:check, starts the wait again.
- Brewless never changes a record at your DNS provider, and a lookup never reaches your application, so no container wakes up for it.
- The domain itself, such as example.eu, cannot take a CNAME; an ALIAS, a redirect to www or moving only that zone to Bunny DNS gets you there.

Moving an app is enough work without moving its DNS too. Many domains have their zone at the registrar or at a DNS provider the rest of the company depends on, with mail, verification records and other sites in it. With [Brewless](/) that zone can stay where it is. This post shows what you make there, what Brewless does by itself, and what happens when something changes later.

## Can I use my own domain on Brewless without moving my nameservers?

Yes. When the zone of your domain is not at Bunny DNS or Scaleway DNS in your own accounts, Brewless shows the one record the name needs, and you make it at your own DNS provider. Brewless then looks that record up by itself and issues the certificate as soon as it points the right way. Your nameservers, and every other record in the zone, stay as they are.

When the zone is at Bunny DNS or Scaleway DNS in the accounts you connected, Brewless makes the record itself; see [Moving your domain to Brewless](https://docs.brewless.eu/getting-started/moving-your-domain).

## Add the domain

```bash
brewless domain:add production shop.example.eu
```

Adding the domain does not wait for the record. It ends with what to make:

```text
WARN  The DNS of shop.example.eu is kept where Brewless does not reach. Make this record at your DNS provider:

    CNAME  shop.example.eu  ->  acme-shop-production.b-cdn.net

  Brewless looks it up every few minutes and issues the certificate by itself once it points the right way.
```

The console shows the same under **Domains** on the environment's **Resources** page, with a copy button on each value. The domain is now **Waiting for DNS**.

> [!TIP]
> Some DNS providers add your domain to the name by themselves. Then enter only the part before it: `shop` for `shop.example.eu`.

## What Brewless does while it waits

| When | What happens |
| --- | --- |
| First 3 hours | Brewless looks the record up every 5 minutes |
| After that | Every hour |
| After 24 hours | The owners of the organisation, and whoever added the domain, get a mail with the record |
| After 36 hours | Brewless stops looking, shows **Stopped waiting** and sends a mail |
| Once the record points the right way | The certificate is issued, the domain is **Live**, and a mail says so |

A lookup is a question to the public DNS. It never reaches your application, so it wakes none of your containers. Did Brewless stop waiting? Make the record and press **Check now** at the domain, or run `brewless domain:check production shop.example.eu`, and the wait starts again. Check now works once a minute per domain.

With bunny.net in front, the name is on the pull zone from the start and only the certificate waits. Without bunny.net the name goes straight on the Scaleway container, and Brewless attaches it only once the record points there: Scaleway looks a name up the moment it is attached, and remembers a miss for up to an hour.

## The domain itself, without www

A `CNAME` may not stand on the domain of a zone itself, such as `example.eu`. For that name Brewless asks for an `ALIAS`, and the console names three ways to get there:

- **Your DNS provider offers `ALIAS`, `ANAME` or CNAME flattening.** Make that record, pointing to the target Brewless shows.
- **Your registrar forwards `example.eu` to `www.example.eu`.** Add `www.example.eu` to the environment instead, with a `CNAME`.
- **Move only this zone to Bunny DNS** in your bunny.net account. Brewless then makes the record itself.

An `ALIAS` answers with addresses, and they need not be the ones Brewless gets for the target, so a lookup cannot always see that it points the right way. Brewless then asks bunny.net for the certificate, and an issued certificate is the proof. It does that at most once an hour, because Let's Encrypt allows only a few failed tries per name an hour.

## After it is live

Brewless looks the record of a live domain up once a day.

- **The record no longer points at the environment.** Somebody changed it, or a new site took the name. The domain shows **DNS changed**, and the owners get a mail with the record that belongs there. Once it is back, the next look sees it.
- **The environment answers on a new address.** Without bunny.net in front, a web container made anew gets a new address from Scaleway. The console shows the new record, a mail says which, and you change it at your provider.

> [!NOTE]
> Brewless never changes a record at your own DNS provider. It says what the record has to be and what it found, and the change is yours. Every step is in the audit trail.

## Every record you keep yourself, in one place

The **DNS** page of the console has a card **Records you keep yourself**. It lists every domain whose DNS is at a provider of your own, for every environment, with its state and what the last lookup found. It also lists the mail records (SPF, DKIM and DMARC) of a sending domain whose zone is kept there, each marked **In place** or **To make**.

From the command line, `brewless domain:list` does the same for one environment:

```bash
brewless domain:list production
```

## Coming from Laravel Vapor

At Vapor, a domain outside Route 53 meant copying records from `vapor record:list` into your registrar. The idea is the same here: `brewless domain:list` shows the records, and the certificate follows once they point the right way. The difference is that Brewless keeps looking, says when a record goes missing later, and never needs AWS for any of it. The rest of the move is in [From Laravel Vapor to European infrastructure](/blog/from-laravel-vapor-to-european-infrastructure), and the details are in [Domains](https://docs.brewless.eu/running/domains#dns-at-a-provider-of-your-own).

## Frequently asked questions

### Do I have to move my nameservers to use my own domain on Brewless?

No. When the zone of your domain is not at Bunny DNS or Scaleway DNS in your own accounts, Brewless shows the record the name needs, and you make it at the DNS provider you already have. Brewless looks it up and issues the certificate once it points the right way.

### How long does Brewless wait for the record?

It looks every 5 minutes for the first 3 hours, then every hour. After 24 hours the owners of the organisation get a reminder by mail, and after 36 hours Brewless stops looking. Make the record and press Check now, or run brewless domain:check, to start again.

### Will Brewless ever change my DNS records?

No. A record at your own DNS provider is yours. Brewless only looks it up in the public DNS. When it no longer points at the environment, or the environment answers on a new address, Brewless says which record is needed, in the console and by mail.

### Can the domain itself, without www, point at Brewless?

A CNAME may not stand on the domain of a zone itself. Use an ALIAS, ANAME or CNAME flattening if your DNS provider offers one, forward the domain to www at your registrar and add the www name instead, or move only that zone to Bunny DNS, where Brewless makes the record itself.

### What is the Brewless counterpart of vapor record:list?

brewless domain:list lists the domains of an environment with their state, and for each domain whose DNS you keep yourself the record to make and what Brewless found the last time it looked. The DNS page of the console lists all of them, mail records included.

Source: https://test.brewless.eu/blog/custom-domain-without-moving-dns