Domain and DNS for an AI-built app (2026)

Who this is for

You shipped from Lovable, Bolt, Replit, v0, Cursor, or another AI builder. People who are not you can open a URL. You bought a custom name, or you plan to. The builder still prints a preview host. You want the real name to point at the live host, stay yours, and send mail that lands.

You are not this page if the app still lives only on a laptop, if only the founder can log in, or if you cannot take the live URL down tonight. Those are harden and people jobs. Open the hire page if the registrar login is a contractor inbox. Open the backup page if you need a file you can import at 11 p.m.

What “own the name” means

A domain name is the address people type. The registrar (the company that sells and renews the name) holds the account that can move it. DNS (the phone book of the internet) is a separate layer: records that say where the name points, and which servers may send mail as you. You can own the registrar and still keep the records on Cloudflare. You can own neither. That is the usual miss after an AI builder.

ICANN’s registrant rights say you must have a registration agreement with an accredited registrar. You must keep the published contact data accurate. You must answer the registrar within 15 days. If auto-renew is on, you must keep the payment data current. “I can open the dashboard” is not the same as “the company is the registrant.”

Write four facts on a card: the registrar, the login inbox, the registrant name and email, and who holds the second factor. If that inbox is a freelancer, move the name to a company account before you point records at ads.

Who owns the registrar

The registrant is the legal holder. The login is whoever can open the shop. They can be different people. A contractor login with the company as registrant is still a risk. A founder Gmail as registrant is a bigger one.

Cloudflare Registrar’s FAQ is blunt. ICANN requires you to verify the registrant email. If the link expires, the registrar must place a hold. Cloudflare then swaps in parking nameservers. The site stops resolving. Founders miss that mail because the registrant is still a personal inbox from the night the builder suggested a name.

A Change of Registrant — first name, last name, organization, or email — needs approval. Cloudflare emails a link. If nobody acts in seven days, the request cancels. Approving applies a 60-day transfer lock unless you opt out before you accept. Keep the company as the registrant before you hire.

The same FAQ says ICANN blocks a registrar transfer within 60 days of a WHOIS change (WHOIS is the public contact record for the name), a registrar change, or a new registration. Cloudflare will wait out that window if you leave the transfer In Progress. Do not change the registrant email the same week you need to leave the current shop.

Auto-renew and registrar lock

Auto-renew is a switch that charges the saved card when the term ends. ICANN puts the duty on you: keep payment current if you chose auto-renew. Namecheap says if auto-renew is off, the service will not renew on its own. You must renew before the date or you may lose the name.

ICANN’s Expired Registration Recovery Policy requires at least two notices before expiry: one about a month out, one about a week out. If the name still expires, a third notice must go out within five days, with how to renew. After delete, gTLD registries must offer a 30-day Redemption Grace Period. ICANN defines an Auto-Renew Grace Period as 45 days after expiry. If the registrant does not explicitly consent to renew, the registrar must delete by the end of that window. Do not treat those windows as a plan. Treat auto-renew plus a current card as the plan.

Registrar lock is the transfer brake. Namecheap calls it a safety feature that stops unauthorized transfers, and says it is on by default. Their unlock steps live under Sharing & Transfer. ICANN’s Transfer Policy lets a registrar set ClientTransferProhibited only with the name holder’s consent in the agreement. If there is no self-serve unlock, the registrar must remove that status within five calendar days of the holder’s first request. Keep the lock on unless you are in a transfer this week.

The same policy lets a registrar deny a transfer within 60 days of creation, and within 60 days after a prior transfer. It must impose a 60-day lock after a Change of Registrant unless the holder opted out. Cloudflare’s FAQ repeats that 60-day block. A “quick rename of the registrant to the LLC” can freeze a needed move for two months.

Point the name at the host

The host needs two lines most of the time: the apex (the bare name with no www, such as example.com) and www. An A record (a line that maps a name to an IPv4 address) is how most hosts take the apex. A CNAME (a line that maps a name to another name) is how most hosts take www.

Cloudflare’s record types say A and AAAA map a name to IPv4 or IPv6. A CNAME maps a name to another canonical name. Vercel’s DNS page matches that split. An A record translates a name into an IPv4 address. Vercel does not support IPv6. Their example A target is 76.76.21.21. Their example CNAME target is `cname.vercel-dns-0.com`. Vercel says a CNAME cannot be used at the zone apex. If your DNS host is Vercel, the apex is an A or an ALIAS, not a CNAME.

Cloudflare is different at the apex. CNAME flattening follows the chain and answers with an IP. Setup says flattening happens by default for every plan when the CNAME sits on the zone apex (`@`). You can put a CNAME on the bare name at Cloudflare. The rest of the internet still sees an A. Do not copy a “CNAME on @” into a registrar that does not flatten. The record will fail.

Vercel’s domain page recommends a redirect from the apex to www. Cookies and CAA records on the apex apply to subdomains. The www name is easier to control. For an AI-built app, pick one origin and make the other redirect. Magic links, cookies, and ads must agree. A leftover `*.lovable.app` or Replit host in mail templates is a second origin. Search the project for preview hosts after you point DNS.

If you bought the name through Vercel, Vercel sets the nameservers. If you bought it at Namecheap and only added a record in the builder, the nameservers may still be the registrar’s. Write which shop answers DNS. A CNAME in the builder does nothing if nameservers were never changed.

The padlock (HTTPS)

HTTPS is the padlock: a certificate that lets the browser encrypt the session. Let’s Encrypt’s FAQ says default certificates last 90 days. There is no exception. They recommend renewing 90-day certificates every 60 days. Short-lived certificates last six days. Renew those every three days.

Let’s Encrypt’s lifetime page (updated 22 July 2026) says 90 days is still the default. A 7 October 2026 post says the default moves to 64 days on 10 February 2027. The last 90-day certificate is expected to expire on 11 May 2027. Manual renewal is a trap. Automation is the job.

Vercel uses Let’s Encrypt. It tries to issue a certificate once the domain is on the project. It only works after DNS is in place and the validation request succeeds. Non-wildcard names use HTTP-01. Wildcard names use DNS-01, which is why a wildcard needs Vercel nameservers. Vercel attempts renewal 14 to 30 days before expiry. Domain renewal is a separate click from certificate renewal. Uploaded custom certificates do not auto-renew.

Cloudflare Universal SSL issues and renews a free certificate after the domain is active. On a full setup it covers the root and first-level subdomains such as www. A leftover CAA record (a line that lists which shops may issue a certificate) that blocks Let’s Encrypt will fail both hosts. Vercel adds a Let’s Encrypt CAA at the apex automatically.

Mail records so mail is not spam

App mail is magic links, receipts, and “reset password.” If those land in spam, the product looks dead. Four DNS lines do the work.

An MX record (mail exchange: the server that receives mail for the name) is required for inbound mail. Cloudflare says an MX record is required to deliver email to a mail server. Vercel does not provide a mail service. You add the provider’s MX and TXT records. If you pointed nameservers at the app host and never copied MX, inbound mail dies the day you leave the registrar’s parking mail.

SPF (Sender Policy Framework: a public list of servers allowed to send mail as you) is a DNS text record. RFC 7208 is the protocol. Cloudflare says an SPF record lists the IPs and domains allowed to send as you. Google Workspace is the setup path if Workspace is the mailbox.

DKIM (DomainKeys Identified Mail: a signature that proves the message was not swapped) is another DNS record. RFC 6376 says DKIM attaches a cryptographic signature and the receiver queries the signer’s domain. Google publishes the Workspace steps. Yahoo asks for a DKIM key of at least 1,024 bits.

DMARC (Domain-based Message Authentication, Reporting, and Conformance: a public rule for mail that fails SPF or DKIM) tells the receiver what to do. RFC 7489 defines it. Google Workspace walks the TXT. Google and Yahoo both accept `p=none` as a starting policy.

Gmail’s sender guidelines started on 1 February 2024. Every sender to Gmail must set up SPF or DKIM, valid forward and reverse DNS (PTR records), TLS, RFC 5322 formatting, and a Postmaster Tools spam rate below 0.3%. Senders of more than 5,000 messages a day to Gmail must set up SPF and DKIM, plus DMARC (`p=none` is allowed), From-domain alignment with SPF or DKIM, and one-click unsubscribe on marketing mail. The FAQ says keep spam below 0.10% and never reach 0.30%. Starting November 2025, Gmail ramps up enforcement on non-compliant traffic.

Yahoo’s sender requirements began in February 2024. All senders need SPF or DKIM and a spam rate below 0.3%. Bulk senders need SPF and DKIM, a DMARC policy of at least `p=none` that passes, From alignment, one-click unsubscribe, and unsubscribes honored within two days. An AI builder that sends from `noreply@the-builder-host` will fail alignment the day you move From: to your name. Publish SPF, DKIM, and DMARC on the sending name before the first ads that trigger mail.

TTL and propagation

TTL (time to live: how many seconds a resolver may keep a copy of a record) is the wait. RFC 1035 defines TTL as a 32-bit interval that a resource record may be cached before the source must be consulted again. Zero means do not cache.

Cloudflare sets Auto to 300 seconds (five minutes) on proxied records. You cannot edit that. Unproxied records on non-Enterprise plans can be 60 seconds to one day. Auto is also 300 seconds. Cloudflare warns that a local cache can take longer than five minutes.

Vercel says full propagation can take 24 to 48 hours because many caches must expire. Their default TTL is 60 seconds. The range they document is 30 seconds to 86,400 seconds (24 hours). If you are moving a live name, they want you to shorten TTL to 60 seconds about 24 hours before the cut. Then change the record. Traffic follows the short cache.

Do not tweet the new URL the minute you save the record. Open the name in a private window. Check the padlock. Send one test mail to Gmail and one to Yahoo. If both fail, wait one TTL, then debug. A loaded page and a landed mail are proofs.

What to hand a developer

A hired person needs the records, not the only login. The hire checklist names the registrar owner. This page names the packet.

• Registrar. Shop name, account inbox, registrant name and email, renewal date, auto-renew on or off, lock on or off, who holds 2FA.
• Nameservers. Often Cloudflare even when Namecheap sold the name. Write which shop answers DNS.
• App records. The A and CNAME that point at the host. Apex vs www. Which one redirects.
• Mail records. MX, SPF, DKIM, DMARC. Which mailbox or sender they serve.
• Zone file. Cloudflare’s import and export page exports a BIND file (a zone file: the full list of DNS records for your name) from the dashboard or the API. The file size cap is 256 KiB. The backup page is where that file lives as a restore copy. This page is why you make it before the hire starts.
• Approvers. Who can unlock. Who can approve a Change of Registrant. Who can halt the host tonight.

Do not paste the registrar password into chat. Invite a role. Keep the company as registrant. If the only 2FA device is the founder phone, name a backup before the sprint. A developer who cannot open DNS cannot fix a magic-link that still prints the builder host.

What to do this week

Keep the week small. You do not need a DNS team. You need a company login and records that match the live host.

1. Move the registrar to a company inbox. Verify the registrant email. Turn on auto-renew with a current card. Turn on registrar lock.
2. Write the nameserver host. Registrar DNS and Cloudflare DNS are not the same shop. Change records where the nameservers actually point.
3. Point apex and www. A or flattened CNAME on the bare name. CNAME on www. Redirect one to the other.
4. Wait one TTL, then check the padlock. Vercel and Cloudflare issue certificates after DNS works. Confirm both names.
5. Publish MX, SPF, DKIM, and DMARC on the sending name. Send one test to Gmail and one to Yahoo.
6. Export the zone file. Keep it with the secrets list on the backup card.
7. Write the handover packet before a developer starts. Invite a role. Do not paste the only password.

If a door is still red — contractor registrant, no lock, preview host in mail — stop buying ads and finish the name. A CNAME cannot invent an Account Holder on Monday.

Next steps

Own the registrar. Lock and auto-renew the name. Point apex and www. Wait for the padlock. Publish the mail proofs. Export the zone file. Name who can change records tonight. Customers should not be the first people who notice the name parks at a registrar ad.

CodeCross is a product studio. The week after an AI-built launch is a live host, a name you own, and records a stranger can already use. If the registrar is still a personal inbox and you want a second pair of eyes, book a conversation.

FAQ

If the AI builder still prints a lovable.app URL, is my custom domain live?

Not for the product. DNS can point the name at the host while mail, Open Graph tags, and magic links still send people to the preview origin. Vercel treats the apex and www as separate names. Search the project for leftover builder hosts after you save the A and CNAME. One origin. One redirect.

Can I put a CNAME on the bare name for Vercel?

Not if Vercel is answering DNS. Vercel says a CNAME cannot be used at the zone apex. Use an A record or an ALIAS there, and a CNAME on www. Cloudflare is the exception: it flattens a CNAME at `@` by default and answers with an IP. Copying a flattened Cloudflare row onto a registrar that does not flatten will fail.

Does a Let’s Encrypt padlock last as long as the domain registration?

No. Let’s Encrypt default certificates last 90 days. Renew them every 60 days. Vercel attempts renewal 14 to 30 days before expiry, and says domain renewal is a separate click. The 64-day default starts 10 February 2027. Automation is the job. A one-year domain term is not a one-year certificate.

If the AI app sends magic-link mail, is SPF enough for Gmail?

For low volume, Gmail requires SPF or DKIM, plus PTR, TLS, and a spam rate below 0.3%. Over 5,000 messages a day to Gmail you need SPF and DKIM, plus DMARC. The FAQ wants spam below 0.10%. Yahoo matches the bulk shape and wants unsubscribes honored in two days. A builder From: that is not your name will fail alignment.

Should a hired developer get the registrar password?

No. Hand the zone file, the record list, and an invited role. Keep the company as registrant. ICANN gives the name holder five calendar days to have ClientTransferProhibited removed if there is no self-serve unlock. A contractor with the only login can move the name. The hire checklist covers seats. This page covers the packet.

If I change the registrant email to the company, can I transfer the name this week?

Usually no. ICANN’s Transfer Policy requires a 60-day inter-registrar lock after a Change of Registrant unless you opted out first. Cloudflare repeats that 60-day block after a WHOIS or registrar change, and after a new registration. Change the email before you need to leave, or opt out of the lock when the shop offers it.