# DNS

Every target gets a hostname on a Kraftify domain, and you can point your own at it instead. There is no port to forward and no dynamic DNS client to run. A database does not need one: it is reached by DSN over TLS, not by name resolution you have to configure.

## The default hostname

```
kraftify deploy --kind container   # eu.example.kraftify.net
```

## Bring your own domain

Add the domain once, then create the record. Kraftify serves the certificate, so HTTPS works the moment the record resolves.

```
kraftify domain add play.example.com
kraftify domain record play.example.com -> <target-id>
```

## Verify

```
kraftify domain verify play.example.com
```

- The record must be an `A` or `AAAA` record pointing at the target connection.
- Verification polls and reports the resolved address, so a stale record is obvious.
- Certificates renew on their own. There is nothing to run on your side.