Info: A custom domain is part of HexOS Anywhere, an add-on for HexOS Lifetime. See Get HexOS Anywhere.
With HexOS Anywhere on, each app you share gets its own HexOS address. If you own a domain, you can use it instead, so Jellyfin answers at jellyfin.example.com. Your connection stays encrypted all the way to your server: we pass it along without reading it.
To use your domain, you add one DNS record where you manage it. A second, optional record keeps your app names private.
New to HexOS Anywhere? HexOS Anywhere covers the rest: turning it on for an app, sign-in, TV and phone apps, and limiting where visitors come from.
example.com, and select Continue.Most providers publish a change within minutes, but some take an hour or more (see your provider below). If the check can't find the record yet, wait a little and select Re-check again.
Once your domain is verified, your apps answer only at their addresses on it, and their relay addresses stop working. Update your bookmarks and the addresses in TV and phone apps. If you remove the domain, your apps go back to their relay addresses.
| Type | Host | Value | |
|---|---|---|---|
| Required | CNAME | * |
The value the Command Deck shows |
| Optional | CNAME | _acme-challenge |
The value the Command Deck shows |
Copy each value with its copy button in the Command Deck. They are unique to your account.
The Command Deck shows the full name, such as *.example.com, but most providers add your domain to the host for you. Type only * (and _acme-challenge for the optional record). If you type the full name, the record ends up at *.example.com.example.com and we won't find it.
The record must point straight at us. A provider setting that sends your traffic through its own servers (Cloudflare's orange cloud, Namecheap's HTTPS toggle) breaks the encrypted connection to your server. Set the record to DNS only.
* record coversThe * record sends every name under your domain to us, except names that already have their own records. Your website at www.example.com, your email and anything else you set up keep working as they are. Those names can't be used for apps, though: an app named www wouldn't be reachable while www has its own record.
Without the second record, your server gets a separate certificate for each app, and every certificate is listed in public logs that anyone can search. That reveals names like jellyfin.example.com, though not what's behind them. With _acme-challenge handed to us, your server gets one certificate that covers all your apps, and their names stay out of those logs.
A CAA record says which certificate authorities may issue certificates for your domain. Most domains have none, and then there is nothing to do. If yours has one, add a CAA record that allows letsencrypt.org, or your server can't get its certificates.
Once your domain is Verified, you can open your server's Command Deck from anywhere at an address on it, such as deck.example.com. We serve it through our relay the same way we serve your apps, so the connection stays encrypted all the way to your server.
deck. Your domain is already filled in beside it.join or a name one of your apps uses.https://deck.example.com, and sign in with your HexOS account as usual.You don't need another DNS record: the * record you added already sends the name to us. If the name has a record of its own at your DNS provider, delete it, because a record for one name takes precedence over the * record. Like an app's address, a new Command Deck address can take a few minutes to start working.
If you run a reverse proxy, you can instead give the Command Deck an address on another domain and serve it from your proxy:
nas.example.net, its host is _hexos-dashboard.nas, and its value starts with hexos-dashboard=.To set up the proxy itself, see VM console and remote access for the ports your server's own interface uses.
*, and _acme-challenge for the optional record._acme-challenge: a flattened record hides the CNAME we look for._acme-challenge TXT records behind that don't always appear in the dashboard. If the optional record won't verify, check for them.Cloudflare: wildcard DNS records · Proxy status
*. Namecheap adds your domain itself, so don't type it.* host.Namecheap: wildcard subdomains · CNAME records
*, without your domain.* CNAME for every domain. If it refuses the record, you can move your domain's DNS to a provider that does, such as Cloudflare, and keep the domain registered at GoDaddy.pixie.porkbun.com, including one at *. Delete them first, or Porkbun refuses the new record because "a CNAME or ALIAS record with that host already exists".*, without your domain._acme-challenge TXT records. Delete them before adding the optional record; a CNAME can't share a name with other records.* record.Porkbun: wildcard records · Record already exists · Parking
*.* CNAME. If it refuses the record, you can move your domain's DNS to a provider that does.Squarespace: edit your DNS records
*. Record type: CNAME..), or Gandi adds your domain to the end of it.* CNAME there.* A record. Delete it before adding the CNAME.| The Command Deck says | What to do |
|---|---|
| We couldn't find the record yet | Check that the host is only *, then give it time: some providers take an hour or more. |
| The record points somewhere else | Copy the value again with the copy button, and check that the record isn't proxied. |
| This domain is already connected to HexOS somewhere else | Remove it where it's connected, then select Re-check. |