Skip to main content
Domains allow you to access your Pangolin resources through custom URLs. Pangolin supports different domain types depending on your deployment model and requirements.

​
Getting Started

In Pangolin Cloud, a domain is not required. You can use our provided domain endings like .hostlocal.app or .tunneled.to for your resources on any of the paid plans.

​
Domain Types

Wildcard (A record) domains are the most common setup for Self-Hosted, since you already control the server’s DNS and just point it at your VPS IP.

​
Delegating a Domain to Pangolin Cloud

Domain delegation and single-domain (CNAME) setups exist because, unlike self-hosting, Pangolin Cloud doesn’t run on a server whose IP you control — your traffic is routed and terminated on Pangolin’s infrastructure instead. For Pangolin to issue certificates and route traffic for your domain, it needs to be able to create and update DNS records on your behalf.
  • Self-Hosted: You point A/AAAA records at your own VPS’s IP address. DNS stays with your existing provider; Pangolin never needs access to it.
  • Cloud: There’s no single static IP that’s “yours” to point at, and Pangolin needs to create records (for certificate validation, routing, and new resources) without you manually updating DNS every time. Delegation and CNAME setups solve this by giving Pangolin either full control over the zone (NS delegation) or a single record it can manage (CNAME).
Domain delegation is the more powerful option since new subdomains work automatically, but it comes with a real tradeoff: it hands over the nameservers for the whole domain (or subdomain), not just the records Pangolin needs.

​
Setting It Up

​
Self-Hosted (Wildcard / A Records)

1

Point DNS at your server

In your DNS provider, add an A record (or AAAA for IPv6) for the wildcard and, optionally, the root domain, pointing to your VPS’s public IP:
2

Wait for propagation

DNS changes can take anywhere from a few minutes to 48 hours to propagate.
3

Add the domain in Pangolin

Configure the domain in config/config.yml or through the Pangolin dashboard so Traefik can request certificates for it.
More detail on ports, firewalls, and networking for self-hosted setups is in the DNS & Networking Section.

​
Cloud & Enterprise (Delegation or CNAME)

1

Add the domain in the Pangolin dashboard

From your organization’s domain settings, add the domain and choose either Domain Delegation or Single Domain (CNAME). Pangolin will show you the exact records to configure.
2

Configure DNS at your registrar/provider

Change the nameservers for the domain (or subdomain) to Pangolin’s, as shown in the dashboard:
This is done at your registrar or in your current DNS provider’s nameserver settings, not as a normal DNS record.
3

Wait for verification

Pangolin checks for the records automatically. NS delegation can take longer to propagate than a CNAME since it changes how the entire zone (or subzone) resolves.
Changing nameservers hands over the whole zone, not individual records. If you point the nameservers for your root domain (e.g. example.com) at Pangolin, Pangolin becomes authoritative for every record on that domain — including MX/email, TXT/SPF, and any other subdomains you weren’t intending to move. Once delegated, you manage DNS for that zone through Pangolin, not your old provider.Some registrars — Cloudflare included — only let you delegate NS records at the root, and don’t allow you to add other records once Cloudflare is no longer authoritative for that zone (since it’s no longer serving the zone at all). Practically, this means:
  • Delegating *.example.com moves the entire domain, including email and any other services, to Pangolin’s nameservers.
  • Delegating a subdomain instead (e.g. *.apps.example.com) avoids this — the root domain and its other records stay with your existing provider untouched.
  • If you must delegate the root and still need other records (MX, TXT, etc.) that your old provider managed, check whether Pangolin’s DNS supports adding them directly, or use a subdomain delegation / CNAME setup instead.