How to set up a custom short domain, step by step

Pick the hostname first

You have two options: a subdomain of your main site (go.brand.com) or a separate short domain (brnd.co). A subdomain is free, inherits trust, and never interferes with your website. A separate domain is shorter and better for print and SMS, where every character costs money.

The DNS records

For a subdomain, add a single A record pointing the subdomain to your provider's redirect IP, or a CNAME to their CNAME target. For an apex domain (brnd.co with no prefix), you must use an A record — the DNS specification does not allow a CNAME at the apex alongside other records. Add a CNAME for www pointing to the same target so www.brnd.co works too.

The apex-domain warning

If your main website already lives at the apex of the domain you are about to point at a shortener, stop. Changing that A record moves your entire website. Use a subdomain instead, or use a domain you do not serve a site from.

SSL happens automatically — after DNS

Certificate issuance validates that you control the domain by fetching a token over HTTP. That only works once DNS resolves to the provider. So the order is always: add DNS record, wait for propagation, then the certificate appears. If SSL is stuck, the cause is almost always DNS, not the certificate authority.

Propagation reality

Most records resolve within five to fifteen minutes. The old "48 hours" advice reflects TTLs that almost nobody uses any more. If it has been an hour, check for a conflicting record: a leftover AAAA record, a CAA record that blocks your certificate authority, or a proxy sitting in front of the record and hiding the real answer.

Verify like the server does

Use dig or nslookup against a public resolver rather than trusting your browser, which caches aggressively. Confirm the A record returns the expected IP and that no AAAA record returns something else — dual-stack clients prefer IPv6 and will silently use the wrong answer.