Wildcard custom domains

A wildcard domain lets every subdomain of your domain — app.example.com, api.example.com, anything.example.com — reach the same service without adding each one individually. Simplifyd Cloud provisions a single wildcard TLS certificate that covers all of them.

When to use a wildcard domain

If you only need a small fixed set of subdomains, adding them individually as standard custom domains may be simpler.

Prerequisites

• A service with at least one ingress configured.
• Access to your domain's DNS settings (your registrar or DNS provider).
• Your DNS provider must support CNAME records on * and _acme-challenge subdomains. Most do.

Adding a wildcard domain

1. Click the service node on the canvas to open the service panel.
2. Go to the Settings tab.
3. Under the ingress entry, click Add Custom Domain.
4. Enter the wildcard form of your domain: *.example.com.
5. Click Apply in the Apply Changes bar.

Simplifyd Cloud will display two DNS records you need to create.

Configuring DNS

Wildcard domains require two DNS records — one for traffic routing and one for TLS certificate validation. Both must be in place before the domain becomes active.

Record 1 — traffic routing

Routes all subdomain traffic to your service.

Record 2 — ACME certificate validation

Allows Simplifyd Cloud to prove to Let's Encrypt that it controls your domain when issuing the wildcard certificate. This uses a DNS-01 ACME challenge via CNAME delegation.

How the ACME CNAME delegation works

When Let's Encrypt validates your wildcard certificate, it looks for a TXT record at _acme-challenge.example.com. Because Simplifyd Cloud does not control your zone directly, the CNAME record redirects that lookup to a subdomain of simplifyd.net that Simplifyd Cloud owns and can write TXT tokens to on your behalf. This is the standard ACME CNAME delegation pattern — no NS delegation, no zone transfer.

Waiting for propagation

DNS changes can take a few minutes to several hours to propagate depending on your provider and TTL settings. Simplifyd Cloud checks the CNAME delegation automatically and begins issuing the certificate once both records are detected.

You can monitor progress in the Settings tab — the domain status will update in real time.

Certificate status

If the status stays on Error, verify:

1. The * CNAME points to the Simplifyd-provided value (not your own server).
2. The _acme-challenge CNAME points to the full _acme-challenge.…simplifyd.net value, with the prefix included.
3. No conflicting NS record exists on _acme-challenge.example.com.

Limitations

• Apex domain not supported. A wildcard *.example.com does not cover the root example.com itself. If you need the apex, add it as a separate standard custom domain.
• Single level only. *.example.com matches foo.example.com but not foo.bar.example.com. Deeper nesting requires a separate wildcard such as *.bar.example.com.
• One wildcard per ingress. Each ingress supports one wildcard domain. You can still combine it with individual custom domains on the same ingress.

Removing a wildcard domain

1. Open the service panel → Settings tab.
2. Find the wildcard domain entry and click the trash icon next to it.
3. Click Apply to confirm.

After removal, subdomain traffic will no longer reach your service. Remove or update both DNS records (* CNAME and _acme-challenge CNAME) at your DNS provider to avoid dangling pointers.