Custom domains

Custom domains live under Networking. Add a root domain such as example.com, prove ownership with one TXT record, then create as many subdomain routes as you need: media.example.com, assets.eu.example.com, and so on. Each route points at one bucket or one worker and reports its own status.

Add a root domain

Choose Add domain and complete the setup flow:

1. Domain. Enter the root domain you own, such as example.com.
2. Verify. Add the TXT record shown by the wizard at _anythingcloud.example.com, wait for DNS to update, then choose Verify TXT record.
3. Connect. Point the wildcard CNAME at the edge.

The Domains table stays compact. Choose Manage on a root to open its TXT record and CNAME target in a popup without leaving Networking. Adding the host that uses the domain is a separate step.

TXT verification

The wizard creates a random token for the root domain. Add this record at your DNS provider:

Type	Name	Value
TXT	_anythingcloud.example.com	The token shown in the wizard

The TXT record proves you control the root domain. It does not route traffic. Verification can take a few minutes while DNS changes propagate. The domain stays in Pending TXT until you choose Verify TXT record and the matching record is visible; it is not polled in the background.

Point DNS at the edge

After verification, point the branch wildcard at the edge:

Type	Name	Value
CNAME	*.example.com	edge.anything-cloud.com

Use DNS only (grey cloud) in Cloudflare. A proxied record can return Cloudflare errors 525 or 1014 during certificate issuance, and it interrupts large uploads. Keep the record DNS-only.

Point the apex (@) at the edge as well if you need it. The edge issues a certificate for the apex and www whenever they resolve to it, and shows the default page until a host is added.

For a deeper name such as assets.eu.example.com, a wildcard for example.com only covers one label. Add a wildcard for that branch too:

Type	Name	Value
CNAME	*.eu.example.com	edge.anything-cloud.com

Add a host

Choose Add host from Networking. Pick a bucket or worker, choose a verified root domain, and enter the subdomain. One or more dot-separated labels are allowed, and @ routes the root domain itself. The page previews the full hostname before you save it. Worker routes can also be added from the worker's Triggers tab.

A root can have many hosts. Each host is independent, so media.example.com and assets.example.com can point at different targets.

When a bucket has a custom host, Networking shows the custom host instead of the default S3 endpoint. The S3 endpoint is still available on the bucket's Access and Settings tabs.

Statuses

Root ownership and route health are separate:

Status	Meaning
Pending TXT	Root ownership: the TXT record has not been seen yet.
Verified	Root ownership: the TXT record matched.
Setting up	Route: created, waiting for DNS and the edge certificate.
Active	Route: the certificate is installed and the hostname is routed.
Ready	Automatic worker address: reserved and ready for the worker.
Error	Root or route: open the setup page for the reason.

Bucket endpoint rows show Active while the account is active. Public or Private describes the bucket's read access, not the route status.

Route settings

Bucket routes have a settings button. The Target section changes which bucket the hostname serves. The hostname and certificate stay the same, and the route shows Setting up until the edge applies the new target.

The Edge options section has two security switches for bucket routes:

• Allow WebSocket connections. Adds the upgrade headers and a longer connection timeout so long-lived WebSocket sessions pass through the edge.
• Block common exploit paths. Rejects scanner traffic such as WordPress probes, .env, .git, phpMyAdmin, and cgi-bin before it reaches the bucket. This is on by default for custom bucket hosts.

Worker routes do not have these switches. Their mode is a label chosen when the route is created: HTTP for normal request hosts or Webhook for provider callbacks. Both forward requests to the worker, so the worker should reject methods it does not accept. The route is managed from the worker's Triggers tab.

Bucket endpoints keep their own rate limits and abuse protection. The exploit-path switch applies to the routed host because it may front an application later.

Remove a domain or route

Removing a route deletes only that hostname. Removing a root domain also removes every route under it, and the edge drops those hosts on its next pass.

Private buckets

A private bucket keeps the same public endpoint. Anonymous reads return 403 AccessDenied; reads and writes signed with your access keys work normally. The console creates short-lived signed links for objects in a private bucket. Each signed link expires on its own, and anyone with the full link can read that object until it expires. Signed links use the same endpoint as the bucket page.

Targets

Networking routes to buckets and workers. The Add host form lists both under Serve, and the Hosts table shows the target type. A worker route is tied to that worker; deleting the worker removes its routes.