DNS records
The four records a custom domain needs, what each one does, and how Modulify reports on them.
On this page
When you connect a custom domain, Modulify requests a certificate for it and then shows you the exact records to create at your DNS host. Four records are listed per hostname, and the domain is only reported as Connected once all four resolve.
The four records
The table below is what the Domain tab shows for a root domain such as example.com. Names are displayed relative to your domain, so the apex reads @ and everything else is a bare prefix.
| Name | Type | Value | Why it is there |
|---|---|---|---|
@ |
A | An IPv4 address of the machine serving your site | Sends IPv4 visitors to your site |
@ |
AAAA | An IPv6 address of the same machine | Sends IPv6 visitors to your site |
_acme-challenge |
CNAME | A hostname ending in .flydns.net. |
Proves you control the domain so the TLS certificate can be issued and renewed |
_fly-ownership |
TXT | A short token beginning app- |
Ties the hostname to your site's app so nobody else can claim it |
For the www hostname the same four records appear with www in the name: www, www, _acme-challenge.www and _fly-ownership.www.
The exact values are unique to your site and are shown in the tab. Click any name or value to copy it.
Why all four are required
The A and AAAA records carry traffic. Without them nothing reaches your site at all, whatever else you add.
The _acme-challenge CNAME and the _fly-ownership TXT are the certificate's validation channel. A certificate is not issued once and forgotten, it is renewed repeatedly for as long as the domain is connected, and these two records are what make that renewal possible without any action from you.
They matter most in the case that is easiest to get wrong. If your domain sits behind a proxy, the address records point at the proxy rather than at your site, so the only channel left that can prove ownership is the _acme-challenge record. Leave it out and the certificate eventually fails to renew even though the site looks fine today.
Modulify therefore treats Connected as "configured as instructed" and requires all four. A site whose A and AAAA records are correct can start answering over HTTPS before the other two are added, and it will still read Pending until they are.
The Status column
Each row carries a status once the records exist. Modulify resolves every name through public DNS while the Domain tab is open.
| Status | Meaning |
|---|---|
| Valid | The record resolves and holds the expected value |
| Pending | The record does not resolve yet, which is normal right after you add it |
| Invalid | Something is at that name, but not what is needed. A red banner under the row says what |
| Unknown | The lookup itself did not come back. Nothing is known about the record either way |
Above the table sits the reminder "DNS changes can take a few minutes to propagate."
Where to add them
The line above the table names the zone: "Add the following records at the DNS host that manages example.com (not any other domain)." That is the host whose nameservers your domain currently uses, which is not always the company you bought the domain from.
If Modulify detects that your nameservers are Cloudflare, a second amber line appears: "On Cloudflare? Set each record to DNS only (grey cloud), not proxied. Orange records break SSL."
Relative and absolute names
Most DNS panels expect the name relative to your zone, which is what Modulify displays. A few expect the full hostname. If your provider's form already appends your domain for you, paste _acme-challenge, not _acme-challenge.example.com, or you end up with _acme-challenge.example.com.example.com, which resolves to nothing and is invisible unless you look for it.
One click setup
For some DNS providers Modulify can write the records for you. When yours supports it, a button appears above the table reading Configure automatically with <your provider>, carrying the provider's icon. Clicking it opens a popup at your provider where you approve the change, and Modulify re-checks the records when you close it.
The button only appears when your provider advertises support and at least one hostname is still unconnected. GoDaddy is explicitly excluded, so its customers add the records by hand. If the button is there but the request cannot be built, the error toast reads "Automatic setup unavailable" with "Add the DNS records manually below!".
What Modulify never asks you to change
Modulify only ever asks for the four records above, plus their www counterparts. It does not ask for nameserver changes, MX records, or anything to do with your email. Records at other names in the same zone are left alone and do not affect the connection.
Next
- Connect a custom domain walks the setup end to end.
- Troubleshoot a domain covers a domain that stays Pending.
- www and apex domains explains the second set of records.