Add the hostname, create the DNS records shown, and issue links on your own name once verification passes.
Custom domains are a paid feature: Pro includes 1, Business up to 10.
1
Add the hostname
A subdomain such as go.yourcompany.com is the usual choice. Apex domains work too, with an A record instead of a CNAME.
2
Create the records we show you
The dashboard prints the exact name and value for your zone, with a copy control on each. Nothing has to be typed by hand.
3
Run the check
Verification resolves DNS from our side and tells you precisely what it saw — not just "failed". If your zone has a long TTL, wait it out and check again.
4
Issue links
Once the domain is verified, choose it in the create-link dialog. Links already issued on our domain keep working; the two live side by side.
Method
Record
Value
TXT (ownership)
_paddek-challenge.yourdomain
The token shown in the dashboard
CNAME (subdomain)
go.yourdomain
cname.paddek.com
A (apex)
yourdomain
76.76.21.21
An apex domain cannot be a CNAME
RFC 1034 forbids a CNAME alongside other records at a zone apex, which is why an apex domain uses an A record. Some providers offer ALIAS or ANAME records that work around this; either is fine.
The four causes that account for nearly every failed domain check.
The record has not propagated yet. Your registrar’s control panel shows the record the moment you save it; resolvers elsewhere still hold the old answer until the TTL expires. Lower the TTL before you make the change, not after.
The record name has the domain appended twice. Many panels add the zone for you, so entering "go.example.com" produces "go.example.com.example.com". Check what the panel actually saved.
A proxy sits in front of the record. If your DNS provider proxies traffic (an orange cloud, for instance), the CNAME we look for is hidden behind their address. Set the record to DNS-only while verifying.
The wrong method for the record type. An apex domain with a CNAME will never verify. Switch the method to A record — you can change it without deleting the domain and losing its links.
The verification result names the record it queried and the value it received, so comparing that against your zone usually identifies the problem in one read.
Where the certificate comes from and what to expect in the first few minutes.
Certificates are issued for a custom domain once it resolves to us. Until issuance completes the domain’s SSL status is shown as pending in the dashboard, and a browser reaching it early may warn.
Do not print the URL until the padlock is real
Check the domain in a browser, on a device not on your office network, before the URL goes anywhere you cannot recall.
Configure where https://go.yourcompany.com/ sends visitors, and where an unknown slug goes.
Both are per-domain settings. The root redirect handles someone who types the bare hostname out of curiosity; the not-found URL handles a mistyped or retired slug.
Root redirect — usually your main website. Leave it unset and the bare hostname returns a plain 404.
Not-found URL — usually a landing page explaining the link has moved. Leave it unset and unknown slugs return a plain 404.
The product is never served on your brand
Dashboard, admin and marketing routes return 404 on a customer domain. Your domain serves your links, your Bio Pages and nothing of ours.
Did this leave something unanswered?
Tell us what you were trying to do — it is how these articles get written.