Custom domains for SaaS: every option compared (2026)

• Your app already serves the traffic and the hard part is getting customers to create the right record: you want the DNS layer (DoDomain, Entri).
• You need HTTPS terminated for thousands of customer hostnames and proxied to your app: you want an edge (Cloudflare for SaaS, Approximated, SaaS Custom Domains).
• You host on Vercel, Fly.io, Render or Netlify: your host already issues certificates for customer domains. The customer still has to create the record themselves.
• You want no vendor at all: Caddy's on-demand TLS on your own servers, with your own instructions page for the DNS.
• At scale, most products run one of each: a DNS-layer product to get the record in and keep watching it, and an edge or host to serve the traffic.

Getting the record in. The customer's domain lives at their DNS provider: Cloudflare, GoDaddy, Route 53, a registrar's own DNS. Something has to create a record there that points the name at you. Either the customer does it by hand from your instructions, or a product does it for them through an API the provider exposes: OAuth into the provider, the Domain Connect protocol, or an API token the customer pastes in. This is the step where customers give up. It is unfamiliar, every provider's dashboard is different, and a single wrong character fails silently.

Proving it and keeping it proven. Once the record exists, someone has to confirm it really resolves (ideally at the domain's own nameservers, not through a cache that may lag for hours), tell your backend the moment it does, and notice when a customer later edits or deletes it. Every product here does some version of the first check. They differ widely on the second.

Serving the domain. When a visitor types the customer's domain, something has to answer: terminate TLS with a certificate for that exact name and route the request to your app. Hosts do this for apps they run. Edges do it for apps running anywhere. Caddy does it on servers you operate.

The lines have blurred in 2026. Entri sells an edge through its Power and Secure add-ons, and Approximated writes records where a supported Domain Connect integration exists. The tables below say exactly who does what, so a feature list that looks the same can be read for what it is.

Headline prices compare nothing here, because these products meter different things. Fly.io and Render bill every hostname that is live, every month; Cloudflare for SaaS bills per additional hostname, and its pages state no billing period. Entri sells an annual allowance of new connections on flat tiers. Vercel includes domains in the hosting plan. DoDomain counts a domain once, in the month it first verifies, and charges nothing to keep watching it. So each scenario states both numbers: customer domains added a month, and customer domains live at once.

List prices, the custom-domain line only, monthly where the vendor states a period (Cloudflare for SaaS's pages state none for its rate). Excluded because they are not about custom domains or not published: a Cloudflare zone plan, bandwidth above an edge's included allowance (Approximated includes 400 GB), a host's plan and compute, and every tier a vendor quotes only through sales. DoDomain's plans below Pro are the guided-records flow; one-click starts there. The products do different jobs, so the cheapest row is not automatically the right one: read the next sections first.

In every host case the customer still creates the record by hand, and the host checks it only so it can issue a certificate. Pairing a host with a DNS-layer product is the same pattern as pairing an edge with one.

Namecheap and Cloudflare Registrar are not alternatives to anything above. They are where a customer's domain may already be registered, and so where its DNS may live. DoDomain is not a registrar and does not host DNS; its terms say records are written to your users' existing DNS accounts and the domains remain theirs. It reads the nameservers a domain already has and works with what it finds, so a customer is never asked to move a domain or change its nameservers.

Provider facts read from each provider's own documentation on 2026-10-23, linked above. Check their pages for current terms.

1. Start with where the traffic goes. If you already serve customer hostnames (a host that takes them, an edge you pay for, or your own Caddy or nginx), you only need to decide how customers get their record right. If you do not, choose the edge or host first; the DNS layer points at whatever you pick.
2. Pick an edge by what it is protecting. Already on Cloudflare and want its network and WAF in front of tenants: Cloudflare for SaaS. Want a dedicated cluster and IP, or self-hosting later: Approximated. Want security controls as the headline: SaaS Custom Domains.
3. Pick the DNS layer by where your customers' domains live. A Cloudflare-heavy base gets a one-click from DoDomain and Entri alike. For GoDaddy, IONOS and the long tail, check each product's provider list: Entri documents the most providers. GoDaddy serves DoDomain's Domain Connect templates; IONOS does not, so IONOS customers get its guided records (the provider matrix is measured nightly).
4. Price on the meter you will actually hit. A product that adds a hundred domains a month and keeps them for years pays very differently on a per-live-domain meter than on a per-new-connection one. Use the three scenarios above, or plug in your own numbers against the rates in the tables.
5. Ask what happens after go-live. How often is the record re-checked, how is a false alarm ruled out, and how does your backend hear about a break? Customers change DNS providers and delete records years later; the product that notices first saves the support ticket.

The record a session asks for is whatever your edge or host needs: a CNAME to the hostname your Cloudflare for SaaS zone exposes, an A record to an Approximated cluster address, the target Vercel returns when you add the domain. Below, customers.yourapp.com stands for that target. DoDomain gets the record created in the customer's DNS, proves it at the authoritative nameservers and calls your webhook; your edge or host issues the certificate and serves the traffic.

// 1. Your server: mint a connect session for the customer's domain.
import { DoDomain, verifyWebhook } from "@dodomain/node";
import { env } from "./env"; // your validated server env

const dodomain = new DoDomain({ secretKey: env.DODOMAIN_SECRET_KEY });
const session = await dodomain.sessions.create({
  domain: "customer.com",
  records: [
    { type: "CNAME", host: "app", value: "customers.yourapp.com" },
  ],
  returnUrl: "https://yourapp.com/settings/domains",
});

// 2. Your page: open the connect sheet with session.token.
import { showDoDomain } from "@dodomain/connect";

showDoDomain({ token, onVerified: ({ domain }) => markDomainLive(domain) });

// 3. Your webhook route: DoDomain calls it once the record is live at the
//    domain's authoritative nameservers, and again if it ever breaks.
if (!verifyWebhook(env.DODOMAIN_WEBHOOK_SECRET, rawBody, signatureHeader)) {
  return new Response("bad signature", { status: 400 });
}

From Pro up, the session picks the path on its own: a Cloudflare-hosted domain gets the OAuth one-click, a provider that has enabled DoDomain's Domain Connect templates gets a signed apply, and every other provider gets step-by-step records for that provider's dashboard. On the free plan every provider gets the step-by-step records. The full walkthrough is in the quickstart.

• You only need HTTPS served. DoDomain never terminates TLS. If your customers are developers who will happily paste a CNAME, an edge or your host alone may be all you need.
• One-click at IONOS matters more than anything else. DoDomain gives IONOS customers guided records today. Entri's provider list names it.
• You want to sell domains inside your product. Entri Sell offers this; DoDomain does not.
• You want one vendor for both halves. Entri (with Power and Secure) sells both; Approximated also writes DNS where a supported provider integration exists.
• Procurement needs a SOC 2 report today. Entri states SOC 2 Type II compliance on its product pages; DoDomain does not publish one.

• Entri alternative
• DoDomain vs SaaS Custom Domains
• With Cloudflare for SaaS
• With Approximated
• State of Domain Connect: which DNS providers support one-click

No card, no sales call: create an app, mint a session, and watch the first domain verify.