Updating your domain's DNS for SiteDetour
Exact DNS records to add for apex vs subdomain, how SiteDetour verifies them, and propagation guidance.
Overview
For SiteDetour to serve a redirect, the source domain must resolve to SiteDetour's edge. This article is the authoritative reference for which records to add, where, and how to verify.
Apex vs. subdomain
Apex / naked domains (example.com)
Add the A records displayed in the View DNS Instructions panel on the redirect editor. Always use the values shown in the panel — they are the authoritative source for your account.
Most DNS UIs let you add multiple A records for the same hostname. Add all of them — SiteDetour's edge is redundant, and routing-around-outages depends on every listed record being present.
Subdomains (docs.example.com)
Add a CNAME record. The target is displayed in the DNS Instructions panel; it will look like a SiteDetour-managed hostname:
docs.example.com. IN CNAME <hostname-from-panel>.
The www subdomain
If you use Include www subdomain on a redirect, add a CNAME for www.example.com pointing at the same hostname shown in the panel. A single redirect record then handles both apex and www.
AAAA (IPv6) records
If you currently have AAAA records at the domain, they need to go. Either delete them, or update them to the IPv6 records shown in the DNS Instructions panel (when IPv6 is available for your plan). Leaving stale AAAA records causes dual-stack clients to try IPv6 first and fail.
CAA records
CAA (Certification Authority Authorization) DNS records restrict which CAs can issue certificates for your domain. If you have CAA records configured, you must authorize SiteDetour's CA for certificate issuance to succeed. If you don't use CAA records, you can skip this section; if you do, contact support for the exact value to add.
How SiteDetour verifies
The DNS Instructions panel shows both Expected DNS Records and Currently Resolved DNS Records. SiteDetour runs its own recursive resolver; the "Currently Resolved" section reflects what it sees at that moment, not what your local resolver sees. Click Check Again after a DNS change to force a re-check.
TTLs and propagation
DNS records carry a TTL. Until the current TTL expires, resolvers worldwide serve the cached value even after you've changed the record. Typical propagation windows:
- Subdomain CNAMEs: under 5 minutes with short TTLs.
- Apex A records: up to 24 hours on conservative TTLs.
Plan ahead: 24 hours before an apex migration, drop the TTL to 300 seconds. After the migration stabilizes, raise it back.
Verifying from the command line
Query DNS directly with dig:
dig +short example.com Adig +short docs.example.com CNAME
Bypass local caches by querying an authoritative resolver:
dig @1.1.1.1 example.com A
If the output matches the Expected DNS Records in the SiteDetour panel, you're done.
Common pitfalls
- ANAME / ALIAS — some DNS providers offer ANAME/ALIAS records that let you CNAME at the apex. These work but flatten to A records on resolution; SiteDetour's verification uses the flattened result.
- Split horizon DNS — internal DNS that resolves the domain differently from public DNS will confuse SiteDetour's verification. Public DNS must resolve to SiteDetour.
- Cloudflare proxy on (orange cloud) — proxying through Cloudflare can break IP-based verification. Either set the record to DNS-only (grey cloud), or keep proxy on and enable Reverse Proxy Support in the redirect's Advanced Settings. See Using SiteDetour behind Cloudflare.
- Registrar-level forwarding — some registrars offer URL forwarding as a substitute for DNS. These are incompatible with SiteDetour; delete the forwarding and add real DNS records.
Next steps
