Custom Domains
Serve your links from a domain you own, so they carry your brand instead of ours.
Reviewed 24 Oct 2026
Why bother
go.yourbrand.com/spring is recognisably yours. A shared shortener domain is not, and a reader can see at a glance that a branded link comes from you.
It also means your links belong to you. If you ever move to another provider, you repoint DNS and your published addresses keep working. Links on a shared domain cannot be taken with you.
- Custom domains, by plan
- Free 1 · Starter 3 · Pro 10 · Business 50
The Free plan’s domain
On the Free plan: One custom domain per owner, across all their Free workspaces. The domain must have been registered for at least 30 days, and every destination is screened for malware and phishing.
The Domains page shows whether you can add one right now. New Free domains can be paused while we deal with abuse, and an account newer than 7 days may need to wait; the page says which, with the date the wait ends.
Choosing the hostname
Use a subdomain, not your root domain. go.yourbrand.com, link.yourbrand.com, or a short one like ybr.nd if you own a second domain purely for this.
Do not use the hostname your website is on
- Short is good: it goes in QR codes, print, and character-limited posts.
- Boring is good: go and link read as neutral and trustworthy.
- Pick one and keep it. Changing it later has the same cost as changing a slug, multiplied by every link you have.
How verification works
You add the hostname in ShortZen, and ShortZen gives you two DNS records to publish: a CNAME that routes your traffic and a TXT record that proves you own the domain. You create both at your DNS provider, and ShortZen then polls DNS until it sees them. Nothing needs pressing while that poll is running: verification completes by itself. "Retry verification" is for afterwards: a domain that has not verified carries the action, so once you have corrected the records you can start a fresh check instead of waiting on a poll that has already given up.
HTTPS is handled for you. Once the DNS records resolve, the domain shows as Issuing certificate while one is issued automatically, then moves to Live; you do not have to buy, install, or renew one.
- Waiting for DNS: waiting for both records to become visible: the CNAME that routes your traffic, and the TXT record that proves the domain is yours. Either one missing keeps the domain here.
- Issuing certificate: the records resolved, the certificate is being issued.
- Live: serving redirects over HTTPS.
- Failed: the window ran out, or the certificate could not be issued. Use "Retry verification" on the domain to retry.
- Blocked: verification is paused on our side. Not something you did, and your records are kept; "Retry verification" is refused until it is back, and starts the check once it is.
- Paused by us: ShortZen suspended this domain for a policy violation. Contact support if you believe this is a mistake.
DNS is slow, and that is normal
Using the domain
Once verified, the domain serves redirects like any other. You can put a link on it from anywhere links are created: the dashboard's create-link panel has a domain selector offering every verified domain in your workspace, and the REST API and import both accept a domain the same way.
Staying verified
Live is a state a domain has to keep, not a milestone it passes once. DNS stays yours to change, and certificates expire, so ShortZen re-checks every verified domain on a nightly schedule: that the ownership TXT record is still published, and that the domain still reaches ShortZen over a valid certificate. Any of the three can quietly stop being true months after the domain went live: a record edited during unrelated work, a zone moved to a new provider, a renewal that stops validating.
A failed check does not switch the domain off. Its status is left alone, on purpose: one bad lookup is far more likely to be a resolver hiccup than a real outage, and taking a paying workspace's links down on that would be the worse mistake. What changes is the row: it says we could not confirm the DNS or certificate on the last check, and shows the DNS records again so you can compare them against what your provider is publishing.
If the same check keeps failing on consecutive nights, whoever added the domain is emailed once per episode, not once a night. The email names which of the three checks is failing so you know whether visitors are seeing a dead link, a security warning, or nothing at all yet. A domain that starts passing again clears itself, and no email is sent.
"Check again" on a verified domain runs the same three checks immediately rather than waiting for tonight. Use it after you have corrected a record: if the check passes, the warning on the row clears there and then.
Setting a workspace default domain
A workspace can name one verified domain as its default. Once set, new links default to it instead of the shared ShortZen domain. That applies in the dashboard's create-link panel and through the public API alike, whenever whoever is creating the link does not name a domain explicitly.
Only owners and admins can set or change the default. Open a verified domain on the Domains page and turn on "Use for new links"; turning it off sends new links back to the shared ShortZen domain. That switch is the one place the default is set or cleared. The default applies to new links only; existing links keep the domain they were created on. Only a verified domain can become the default; if it is later removed, the workspace falls back to the shared ShortZen domain until a new default is chosen.
Removing a domain
Removing a domain is disruptive by design, and the confirmation dialog says so before you can proceed: it shows how many of your links are currently on that domain. That count is not the whole workspace's links: it is the ones that stop resolving on this hostname the moment you confirm.
Those links are not deleted and do not break permanently. They are automatically reassigned: to the workspace's own default domain if one is set and still verified, or to the shared ShortZen domain otherwise. Anyone who already has one of those links bookmarked or printed needs the new address: the slug keeps working, but the hostname in front of it changes.
If the domain you are removing is the workspace's current default, removal also clears that setting, and new links go back to the shared ShortZen domain until you choose a new default.
Removal can be blocked by a slug conflict
Because removing a domain can break links that are live in the wild, ShortZen asks you to re-verify your identity immediately before the removal, even if you are already logged in. It is the same step-up check used for other high-impact account actions.
Step by step
Connect and verify a domain you own
For: Workspace owners and admins with DNS access
Before you start
- A domain you control, and the ability to add DNS records for it. Every plan includes custom domains; on Free, the rules in "The Free plan’s domain" apply.
- A subdomain that nothing else is currently using.
Steps
Open Domains.
Choose Add domain, enter the full hostname you want to use, for example go.yourbrand.com, and add it.
The domain appears in your list as Waiting for DNS, and the sheet shows the CNAME and TXT records you need to create, with the setup progress under them. Open the domain from the list, or use Show DNS records on its row, to see them again later.
Copy both records exactly as shown.
Exactly. A trailing dot, a missing subdomain, or the wrong record type all produce the same symptom: it does not verify.
In your DNS provider, add the CNAME record for that subdomain, then the TXT ownership record at _shortzen-challenge.<subdomain>.
Some providers want just the subdomain part in the name field, others want the whole hostname. Check what your provider expects.
Both records are saved and show in your provider's zone.
Return to Domains and wait.
The status moves from Waiting for DNS to Issuing certificate once both records resolve, then to Live once the certificate is issued, usually within minutes and without you doing anything. If you kept the add sheet open, it follows along and ends on your hostname is live, with Create a link on it.
Once verified, open https:// followed by your hostname in a browser.
It responds over HTTPS with no certificate warning.
Create a test link on the domain and open it.
Create a link on it, from the add sheet, starts the new link on the domain. Otherwise pick your hostname under Domain in the create-link panel. The REST API and the importer both take a domain the same way if you would rather work there.
It redirects correctly from your own domain.
What you should see
A verified domain in your list, serving redirects over HTTPS with a certificate you did not have to manage.
How to check it worked
- The domain shows as Live on the Domains page.
- Your hostname loads over HTTPS without a browser warning.
- A link on that domain redirects to the right destination.
Edge cases
- Your DNS provider proxies traffic, for instance with Cloudflare's orange cloud.
- Set the record to DNS-only while you verify: a proxy publishes address records instead of a CNAME, so the initial check cannot see the record it is waiting for. Once the domain is verified you can turn the proxy back on: the nightly re-check asks your domain directly rather than reading DNS, so a proxied record stays healthy.
- Your domain has CAA records restricting which certificate authorities may issue for it.
- Add a CAA record permitting Let's Encrypt: 0 issue "letsencrypt.org". Without it the DNS checks all pass, the domain looks correct everywhere, and the certificate silently fails to issue. Check with: dig CAA yourdomain.com
- The domain was previously on another host and still has an _acme-challenge TXT record.
- Remove it. A stale challenge record left by a previous provider can block certificate issuance for the new one.
- The subdomain already has an A or CNAME record.
- Remove or change the old record. Two conflicting records for one name is undefined behaviour, and whichever wins will not be the one you want.
- You are at your plan's domain limit.
- Add domain is disabled and says why, and a line under the list names the limit. Remove a domain you are not using, or upgrade.
- You want to move a domain from another shortener.
- Add and verify it here first, migrate your links onto it, test, and only then repoint DNS. Read Importing from another shortener before you start.
If something goes wrong
- The domain is still pending, and the row has stopped saying it is checking automatically.
- The poll gave up rather than running forever. Check the record with a public DNS lookup tool rather than trusting your provider's panel. If the lookup does not return the value ShortZen gave you, the record is wrong or has not published yet. Fix it, then use the retry action on the row to start a fresh check.
- The domain shows as failed.
- The verification window ran out, or certificate issuance was rejected. Fix the DNS record (or remove whatever caused the rejection) and use "Retry verification" on the domain to retry. This starts a fresh check rather than resuming the old one.
- The domain shows as blocked, and "Retry verification" is refused.
- This is not something you did: verification is paused on our side, so no new domain can verify until it is back. Keep your records in place and use "Retry verification" later, or contact support if it stays blocked.
- Your website went down after you added the record.
- You pointed a hostname your site was using. Remove the CNAME immediately and restore the previous record; then connect a subdomain that is genuinely unused.