Domains and HTTPS

Buying a domain

Buy from a reputable registrar (Cloudflare Registrar sells at cost; Namecheap and Porkbun are popular). Turn on auto-renew and two-factor authentication on the registrar account: losing a domain to expiry or account takeover is a disaster.

Pointing the domain at your host

Your host gives you a target. Typically:

Add the domain in your host's dashboard first, then create the records at your DNS provider. The Domains & DNS track explains every record type.

HTTPS certificates

Most platforms issue and renew free Let's Encrypt certificates automatically once DNS points at them. Until DNS has propagated, verification fails; wait and retry. Check:

curl -I https://www.myapp.com

One canonical URL

Pick https://www.myapp.com or https://myapp.com and redirect everything else to it (HTTP → HTTPS, apex ↔ www). Duplicate URLs split search ranking and can confuse cookies.

HSTS

After HTTPS works everywhere, send Strict-Transport-Security: max-age=31536000; includeSubDomains so browsers never try plain HTTP again. Do not add preload until you are sure every subdomain supports HTTPS.

Email on your domain

Sending email from hello@myapp.com needs SPF, DKIM and DMARC records, or messages land in spam. See the Email Setup track.

Exercise

Connect a domain (or a free subdomain from your DNS provider) to a deployed app, verify HTTPS, redirect the non-canonical version, and check your headers at securityheaders.com.

Check yourself

• Which record usually points www to a platform?
• Why redirect to a single canonical URL?
• When is it safe to add HSTS?