DNS configuration

The Domain Name System (DNS) maps a hostname such as www.example.com to the network endpoint that serves it.

Easel does not require you to move nameservers. You can keep DNS at your current provider (External DNS) or opt into Easel DNS so Easel hosts the zone and serves flat A/AAAA answers.

After you add a domain, follow the exact records shown in Project settings → Custom Domains (or workspace Domains for Easel DNS zones).

Choose a DNS mode

Mode	What you change	Leaf answer
External DNS (default)	CNAME or A at your provider	Subdomain CNAME → `cname.easelusercontent.com`; apex A → edge IPs
Easel DNS (opt-in)	NS → Easel nameservers	A/AAAA served by Easel for connected hosts

External DNS

Keep your registrar or DNS host. Copy the A or CNAME values from the dashboard into that provider. You do not change NS records.

Easel DNS

Add the apex under workspace Domains, or choose Easel DNS when adding a project domain.
At the registrar, set NS to:
- ns1.easel-dns.com
- ns2.easel-dns.com
Use Check Nameservers until the zone is ACTIVE.
Connected hosts get protected A/AAAA records. Edit MX, TXT, and other types in the DNS Records table.

Deleting an Easel DNS zone while the domain still uses Easel NS takes the domain offline until you point NS elsewhere.

Find the authoritative DNS provider

The registrar is the company where the domain is registered. The authoritative DNS provider is the service named by the domain's NS records.

You must edit records at the authoritative DNS provider (or at Easel when using Easel DNS).

Examples include:

Cloudflare DNS
Amazon Route 53
Google Cloud DNS
Namecheap
GoDaddy
Squarespace Domains

Changing records in a registrar dashboard has no effect when the domain uses nameservers from another provider.

Apex domains (External DNS)

An apex domain is the root hostname:

example.com

Easel requires an A record to the edge IP addresses shown in the dashboard.

Type:  A
Name:  @
Value: <edge IP shown by Easel>

Verification succeeds when at least one of the domain's A records matches an Easel edge IP. Use the values shown for your project rather than assuming a fixed address from documentation.

AAAA records are not part of the current External setup flow. Do not add AAAA unless Easel shows an IPv6 target.

ALIAS, ANAME, or CNAME flattening at the apex is not accepted by Easel's verifier today. Use an A record.

With Easel DNS, the apex A/AAAA records are created automatically when you connect the host.

Subdomains (External DNS)

Subdomains use a CNAME record:

Type:  CNAME
Name:  www
Value: cname.easelusercontent.com
TTL:   Automatic

For docs.example.com, the Name may be docs or the full hostname depending on the provider.

A CNAME record must not coexist with other records at the same exact hostname. Remove conflicting A, AAAA, or CNAME records at that name.

The CNAME target cname.easelusercontent.com is global. It is not workspace-specific or project-specific.

With Easel DNS, subdomains use A/AAAA (not CNAME) so the leaf stays flat.

DNS records used for email

Connecting a website to Easel does not require removing mail records.

Preserve records such as:

MX
SPF TXT
DKIM TXT or CNAME
DMARC TXT
Domain-verification TXT records for other services

Changing nameservers without recreating these records can interrupt email delivery. If you switch to Easel DNS, recreate MX and related TXT records in the Easel DNS Records editor before or immediately after delegation.

TTL and propagation

TTL controls how long DNS resolvers may cache a record. Easel DNS defaults to 300 seconds for new records.

Before migrating an active domain:

Lower the relevant record's TTL in advance
Wait for the previous TTL to expire
Change the record (or NS) to Easel
Verify the new target
Raise the TTL after the migration is stable

A DNS change may appear at different times in different networks because cached answers expire independently. Do not treat a fixed propagation time as a guarantee.

After Easel activates routing, edge manifests refresh on a short TTL (about 30s), so there can be a brief delay before every edge node serves the new assignment.

Proxied DNS providers

Providers such as Cloudflare can proxy traffic instead of returning Easel's endpoint directly.

A proxy can change TLS termination, client IP forwarding, caching, redirects, request headers, security challenges, and WebSocket behavior.

For initial setup with External DNS, use DNS-only (grey cloud) mode until the domain shows a valid configuration and TLS is live. After the domain is live, if you re-enable a proxy:

Terminate TLS at the proxy with a valid certificate for the hostname, or pass through to Easel over HTTPS
Avoid conflicting redirect and cache rules that fight Easel's HTTP-to-HTTPS redirect
Remember that Easel verifies apex domains by A-record IP match; a proxied A record may not match Easel edge IPs during verification

Easel DNS zones are not behind a third-party proxy at the DNS layer.

CAA records

CAA records restrict which certificate authorities may issue TLS certificates for a domain.

Easel uses Let's Encrypt. If the domain has CAA records, they must permit Let's Encrypt:

example.com. CAA 0 issue "letsencrypt.org"

Check CAA on both the exact hostname and the apex when troubleshooting issuance.

DNSSEC

DNSSEC does not normally prevent connecting a domain to Easel, but broken delegation or stale DS records can make the domain fail to resolve or block certificate validation.

When moving nameservers (including to Easel DNS):

Update or remove the old DS record at the registrar
Enable DNSSEC again only after the new provider supports it (Easel DNS does not enable DNSSEC in v1)
Confirm the chain validates before declaring the migration complete

Verify records

Use the Easel dashboard as the source of truth for the required record.

Useful external checks:

dig example.com A
dig example.com AAAA
dig www.example.com CNAME
dig example.com NS
dig example.com CAA

The answer should match the configuration Easel requested.

On this page