Domain ownership
How Easel decides which workspace owns a domain, and how to take over one another workspace holds.
One workspace owns a hostname at a time, and only the workspace that controls its DNS can take it over. For most domains you never see this: the DNS record you add to connect the domain is also the proof. An apex domain or a DNS zone that another workspace holds needs one extra TXT record.
Each domain's CNAME target
Every subdomain on external DNS gets its own CNAME target when you add it, such
as d-3f9c2a71b0de5a17.cname.easelusercontent.com.
Project settings → Domains shows it in the domain's DNS records. The target
stays with the domain for as long as it exists, including when you move it to
another project or its project moves to another workspace, so you never change
DNS for those.
A subdomain only verifies if its CNAME reaches its own target. No other domain is ever given that target, so:
- A CNAME you leave behind after removing a domain is useless to anyone, including your own workspace. Adding the domain again gives it a new target.
- Taking over a subdomain only takes pointing its CNAME at the target the dashboard shows you, which only someone who controls its DNS can do.
The CNAME can reach the target through other CNAMEs. For example,
shop.customer.com → domains.yourplatform.com → <the domain's target>
verifies.
Subdomains under someone else's apex
Workspaces share an apex freely. If another workspace has example.com, you
can still add docs.example.com to your project; point its CNAME at its
target and it verifies like any other domain. The other workspace keeps the
apex and the rest of its domains.
If the other workspace hosts example.com on Easel DNS, the CNAME has to go in
its zone, so it needs to add the record for you.
Take over a domain
When you add a domain another workspace holds, the dashboard shows the record that proves you control it instead of adding the domain:
| You're adding | Record to add |
|---|---|
| A subdomain on external DNS | A CNAME from the hostname to the target shown for your claim |
| An apex, a host on Easel DNS, or a DNS zone | A TXT record at _easel.<registrable domain> with value easel-verify=<hostname>,<token> |
The TXT record goes under the registrable domain, so example.com and
docs.example.com both use _easel.example.com. Its token is specific to your
workspace and the hostname, so copy the value from the dashboard.
To take over the domain:
- Add the record at the domain's authoritative DNS provider.
- Select Verify and add in Project settings → Domains. Under workspace Domains, the button is Verify and Add, or Verify and Connect on a zone's page.
- Once Easel sees the record, the domain moves to your workspace. For an apex or a zone, then add the routing records the dashboard shows.
If the domain doesn't move, wait for the record to reach public DNS and select the button again. You can delete a TXT record once the domain has moved.
Only the hostname you prove moves. Proving docs.example.com never takes
example.com or its Easel DNS zone from the other workspace. Proving
example.com with a TXT record moves that apex to you; if the other workspace
hosts example.com on Easel DNS, that zone and its records are removed.
What happens to the other workspace
When a domain moves, Easel removes it from the other workspace and it stops serving that workspace's project. The workspace's owners and admins get an email that the domain moved.
If the hostname is on another project in your own workspace, you're asked to remove it there first. See Move a domain between projects.
Removed domains
Removing a subdomain on external DNS frees its name right away. Its CNAME points at a target no domain gets again, so nobody can use it without changing the DNS.
An apex's A record and a zone's nameservers point at addresses every workspace shares. When you remove one of those, Easel reserves the name for your workspace for as long as its DNS still points at Easel:
- Your workspace can add the domain again at any time.
- Another workspace needs the TXT record while the A record or the nameserver delegation still points at Easel. Once it doesn't, anyone can add the domain.
- A removed Easel DNS zone reserves every hostname under it as well.
Deleting a project or a workspace reserves its domains the same way. To free a name for good, change its A record or nameservers when you stop using it on Easel.
Domains that never verify
A domain that hasn't verified within 7 days of being added stops holding its name: anyone can add it without proof, and it moves to them. For an Easel DNS zone, Easel checks the nameservers once more first. A zone whose nameservers do point at Easel is marked Active and kept.
A domain that verified once keeps its name even if its DNS changes later.