2026-05-22 · 4 min read

Custom domains in five minutes (mostly waiting for DNS).

A walking tour of how go.yourbrand.com gets to bnkl.me without breaking anything: DNS, TXT verification, automatic SSL, all of it.

Globe icon with a CNAME → bnkl.me arrow

If you're on Pro, you get one custom domain. Most of you will want it. Here's exactly what happens when you add one, both the parts we do for you and the parts your DNS provider needs to do.

Step 1: pick the host

Settings → Custom domain. Type the host you want (typically a subdomain like go.yourbrand.com, links.yourbrand.com, or just l.yourbrand.com. Short subdomains are great for QR codes because they make the encoded URL smaller, which means less dense dots).

Apex domains (yourbrand.com) work in theory but cause more grief than they're worth: they collide with your marketing site, can't use a plain CNAME, and need ALIAS / ANAME records that not every DNS provider supports. Stick to a subdomain.

Step 2: two DNS records

We give you two records to add at your DNS provider:

  • A CNAME record: go.yourbrand.com → cname.vercel-dns.com. This is the one that actually routes traffic.
  • A TXT record on _blinklink-verify.go.yourbrand.com with a per-account verification token. This is how we prove the host belongs to you and not a stranger.

Add both, then click Verify. We resolve the TXT via Cloudflare's public DoH (DNS-over-HTTPS) so we don't need to wait for your local resolver's TTL to expire. Verification usually completes in seconds.

Step 3: SSL just shows up

Once we've confirmed the CNAME is pointed at us, Vercel issues a Let's Encrypt cert via the HTTP-01 challenge automatically. No certbot, no manual renewals. Cert renews every 60 days; you'll never see it happen.

The first 30-90 seconds after verification you might see a placeholder cert from your browser. That's normal. Refresh once after a minute and you'll be on the right one.

What happens at request time

A scan of qr.go.yourbrand.com/abc hits Vercel's edge first. The redirect handler reads the request's Host header, looks up that host's owner_id via a SECURITY DEFINER RPC, and only resolves slugs that belong to that account. Two custom-domain accounts can have the same slug; they're scoped to their owner, not the slug namespace.

Failure modes

  • DNS not propagated yet: Verify says "TXT not found." Wait, retry. Most providers are propagated in under 60 seconds; some (we won't name names) take 24h.
  • CNAME pointed at the wrong place: clicks 404 with a tasteful "unknown host" page until corrected.
  • Apex domain: we'll reject it during add; pick a subdomain.

The walkthrough is in /guides too

If you'd rather follow a checklist than a blog post, /guides/custom-domain has the same content with screenshots and the exact strings you need to type.