Domain DNS setup

DNS decides whether visitors can reach your sites. GOCO has two DNS-related surfaces:

• The DNS page (CF / DNS): bulk-apply DNS records to your own Cloudflare account, including Mode 5 · Hosting, built for Cloud Hosting sites.
• The Sites page: after binding a custom domain, the site detail’s “Domains needing DNS setup” panel lists exactly which records each domain still needs, with per-row copy.

Note

The full step-by-step Cloud Hosting flow (buy → batch → one-click DNS) is in Build with GOCO managed hosting. This page focuses on the records themselves: what each one does, how to push them in bulk, and what to check when they don’t take effect.

Mode 5 · Hosting: what the three records do

Every Cloud Hosting domain needs three DNS records. On the DNS page, switch to Mode 5 · Hosting, paste your domains (or click “Fill my pending domains”), then click “Read records” — the system generates every record each domain needs:

Record	Host	Type	Purpose
① Routing	@, www	CNAME	Points the domain at the GOCO hosting node — the site only opens once this one is added
② Certificate (one-time delegation)	_acme-challenge	CNAME	Lets us issue the HTTPS certificate automatically; one-time, keep it after issuance
③ Ownership	_cf-custom-hostname	TXT	Proves you own the domain, for Cloudflare’s pre-validation

Each record covers one stage, and a missing one stalls exactly that stage:

• Missing ①: the domain won’t open — routing is the precondition for any access.
• Missing ②: the HTTPS certificate can’t be issued; the site stays at “Issuing certificate”.
• Missing ③: ownership can’t be confirmed; the site stays at “Awaiting DNS”. If the site already shows “Active”, ownership was verified long ago — not being able to read ③ is expected, and you don’t need to add it.

Once all records propagate, the site status moves through “Awaiting DNS” → “Issuing certificate” → “Active”.

Caution

If the domain itself is hosted on Cloudflare, the “① Routing” CNAME must be “DNS only” (grey cloud) — an orange-cloud proxy double-proxies, breaking both access and certificate issuance. Records ② and ③ always stay grey cloud.

Can’t add a CNAME on the root domain?

Some DNS providers don’t allow a CNAME on the apex (@). Use the “A record (fallback)” from the record table instead: providers with CNAME flattening can use the CNAME as-is; otherwise add the A record (one or the other). Pointing www first is recommended.

Prefer zero manual records: NS full-managed

When binding a domain you can choose “NS full-managed” (recommended): point the domain’s nameservers (NS) at goco and the platform creates every record (routing / certificate / ownership) for you — no manual DNS entries, and no dependence on whether your registrar supports CNAME flattening. Just set the two nameservers shown on the page at your registrar; propagation usually takes minutes to a few hours, during which the status shows “Awaiting NS delegation”.

The other DNS modes (Modes 1–4)

The DNS page’s “DNS records” tab also offers four general-purpose bulk modes, for scenarios outside Cloud Hosting (e.g. site groups on your own servers):

• Mode 1: all domains resolve to the same value — the simplest bulk pointer.
• Mode 2: free-form — one domain|host|type|value line each, mixing record types and hosts in a single batch.
• Mode 3: round-robin over an IP pool — one IP per domain, restarting from the first IP when the pool runs out.
• Mode 4: domain,value — same host record, a different value per domain.

All four share the same options: TTL (Auto / 60 / 300 / 1800 / 3600 seconds), Proxy (Cloudflare proxies + caches traffic when on), and Replace conflicting (replaces existing records that conflict with this batch).

Bulk-submission notes

Before pushing in bulk, add an operating account (your own Cloudflare credentials) on the DNS page:

• API Token mode is recommended — Zone:Edit, SSL:Edit and Cache:Purge scopes are enough. “Email + Global API Key” also works, but that key is all-powerful; guard it carefully.
• The selected CF account must host each domain’s zone, or the submit fails with “zone not found”.

Limits and habits worth knowing:

• Up to 500 domains per submit (the same cap for every method); extras are truncated — split into batches.
• Cloudflare limits API usage to about 1100 calls / 5 minutes; the page estimates the call count and duration before submit. The live progress panel tracks the task, and for large batches you can enable Offline mode and close the page after submitting.
• When a task finishes you can “Rerun failed” from the progress panel; the full record stays in Task history for 60 days.

Checking your DNS

• Site detail → “Domains needing DNS setup”: lists the records each domain still needs, with per-row copy; click “Check status” to re-verify immediately. You can also click “Copy for batch” and paste the records straight into Mode 5 for bulk submission.
• Sites list “Domain health”: free basic checks (Reachability / HTTPS cert / GFW reference) run automatically for deployed sites; with a boce key configured you also get mainland access speed, DNS resolve, DNS hijack and DNS pollution checks.
• DNS page “Browse zones”: shows every zone in your CF account with its status (Active / Pending NS, etc.) and nameservers.

When records don’t take effect

1. Wait out the TTL first. DNS changes are not visible worldwide instantly: recursive resolvers cache the old value for the record’s TTL — usually minutes, occasionally hours in some regions. After changing a record, wait rather than re-editing repeatedly; if you expect frequent changes, temporarily lower the TTL (e.g. 60 seconds).

2. Verify the records themselves. Common mistakes:

   • The host field contains the full domain. Mode 5 shows the relative form (@ / www / _acme-challenge) — the same record as the full hostname shown on the Sites page. Most providers expect the relative form in their “Host / Name” field; entering the full domain may get the suffix appended again, landing the record in the wrong place.
   • A typo or stray space in the value, or a clash with an existing A/AAAA/CNAME record — bulk submits then report a conflicting A/AAAA/CNAME record; delete the old record first, or tick “Replace conflicting” on submit.
   • A Cloudflare-hosted domain with the routing CNAME orange-clouded (see the warning above) — the site won’t open, or the certificate never issues.

3. Mind registrar differences. Providers disagree on the details: whether the apex supports CNAME (use the A-record fallback if not), whether the host field takes @ or is left empty, and multiple hosts needing ASCII commas as separators. Follow your provider’s conventions — the relative and full-hostname notations are interchangeable.

4. Confirm the zone status. When submitting through the DNS page, the domain must be active in the selected CF account (nameservers already pointing at Cloudflare); records pushed into a “Pending NS” zone don’t serve publicly.

5. Still not live? Open the site detail and click “Check status” for the latest state. If it says the domain is already in use by another account, click “Start transfer” and pass the proof-of-control check to take it over, then finish the DNS setup.

Related pages

Build with GOCO managed hosting (step-by-step one-click DNS)

Site monitoring & domain health