---
title: Site Domains
slug: site-domains
description: Configure the primary hostname through self-managed DNS or the managed domains extension.
productSlug: cedros
productLabel: Cedros
sectionKey: settings
sectionLabel: Settings
docType: subpage
parentSlug: site
adminPaths: /admin/settings/site/domains
---
# Site Domains

The Domains tab appears only when the deployment supports self-managed configuration or the managed domains extension is active.

## Self-managed domains

Set the primary hostname Cedros uses for canonical URLs, trusted browser origins, and generated links. Either keep DNS at your provider and follow the manual routing/TLS checklist, or use Cloudflare automation with a scoped API token and server target. Stored tokens are encrypted and write-only.

For Cloudflare, create an Account API token with a single policy scoped to **Specified Domains** → the selected zone. Under **DNS & Zones** grant **Zone Read** and **DNS Edit**; under **Cache & Performance** grant **Cache Settings Edit** (the zone-level Cache Rules permission). No account-wide policy is needed. **Zone Settings Edit** (DNS & Zones) for HTTP/2 to the origin and **Managed headers Edit** (Rules & Configuration) for visitor-location headers are optional optimizations; Cedros continues with DNS and cache setup when either is unavailable. Cedros encrypts and reuses the token for later DNS and cache updates, so choose an expiration that matches your credential-rotation policy and reconnect before it expires. Website records may be proxied, while mail `A`, `AAAA`, `CNAME`, and `MX` records remain DNS-only.

Native Mail DNS is deliberately staged to avoid routing live mail to an unready server:

1. **Bootstrap** publishes only the unproxied `mail.<domain>` `A` record.
2. Set the server provider's PTR/rDNS for that public IPv4 address to the same `mail.<domain>` hostname. Cloudflare cannot create PTR records.
3. Enable and deploy Native Mail. Wait for host health and the direct-outbound SMTP guard to report active.
4. **Activate** publishes the inbound `MX` and ready mail-policy records. Optional SES outbound records are added later without blocking the inbox.

Cedros adopts an exact existing mail record or updates a record it already owns. It stops with a conflict instead of replacing a different mail host or mixing a new MX route into an existing provider setup.

Cedros automatically reconciles the staged mail records whenever the domain, saved credential, Native Mail host health, SES configuration, or DKIM tokens change. Failed provider calls retry with bounded backoff, successful state is checked again daily for drift, and `cedros.site_settings.domain.status` exposes reconciliation state. Client agents can use the confirmed `cedros.site_settings.domain.mail_dns_sync` action for an immediate repair, but must never request a saved write-only token again or publish `MX` before activation is safe.

For another DNS provider, use **Set it up yourself** and publish every displayed row exactly as shown:

1. Create the displayed website `A`, `AAAA`, or `CNAME` record and configure the origin to serve the hostname with TLS.
2. Publish the displayed mail-host `A` record, then set PTR/rDNS for its IP at the server provider.
3. Enable Native Mail and wait for the host to report healthy before publishing the displayed `MX`, SPF, DKIM, DMARC, and provider-verification records. Do not proxy mail records.
4. Verify website and mail DNS in Cedros before removing the previous route or changing the live MX records.

Do not substitute example or placeholder values. If an exact mail record is not displayed yet, configure Native Mail or the outbound provider first.

## Cedros-managed domains

The same tab becomes a managed-domain workspace: edit the primary website hostname, review DNS/routing status, buy or connect a domain, follow setup progress, and make an active domain primary. A connected Cloudflare zone uses its saved scoped token and the same website-and-mail rules above. Domains registered with or transferred to Cedros reconcile the same staged mail records through Cedros-managed registrar DNS without requiring a Cloudflare token. Connected domains at another registrar require a connected Cloudflare zone or manual DNS. There is no separate Managed Services tab.

Domain and DNS changes can take time to propagate. Do not remove the previous working route until the replacement reports ready.