Setup

Custom Domains

Use your own brand for links: go.yourcompany.com/summer-sale instead of riftl.ink/r/summer-sale. Custom domains also enable universal links and app links.

How it works

Custom domains work by pointing a CNAME record at the Rift server. Rift auto-provisions a TLS certificate via Let's Encrypt and uses the Host header to route requests to the right tenant.

Any DNS provider works — Cloudflare, Route 53, Namecheap, Vercel DNS, etc. No proxy or worker is required.

Note: A verified custom domain is required to use custom IDs (vanity slugs) when creating links. Without a custom domain, links use auto-generated IDs on the shared riftl.ink domain.

Primary & alternate domains

Each tenant registers two custom domains: a primary domain and an alternate domain.

Primary

go.yourcompany.com

Serves landing pages, resolves links, records clicks. This is the domain your users see in URLs.

Alternate

open.yourcompany.com

Used only for the “Open in App” tap. No landing pages, no click recording, no analytics.

Note: Why two domains? iOS and Android don't trigger Universal Links / App Links when the tap originates from the same domain as the link destination. The landing page lives on your primary domain, so the “Open in App” button must point to a different domain for the OS to intercept the tap and open your app directly.

Both domains use the same AASA serving and the same verification flow. The CLI sets up both in sequence.

Set it up

The CLI handles domain registration, DNS verification, and connectivity testing. It prompts you through both your primary and alternate domain in one flow.

rift domains setup

What the CLI handles

1. Recommends a primary domain like go.yourcompany.com

2. Registers the domain with Rift and shows you the CNAME and TXT records to add

3. Waits for DNS propagation and verifies ownership

4. Waits for TLS certificate provisioning

5. Tests connectivity through your custom domain

6. Continues into your alternate domain setup

DNS records

For each custom domain, add two DNS records at your DNS provider:

Type	Name	Value
CNAME	go	returned by the API as `cname_target`
TXT	_rift-verify.go	returned by the API as `verification_token`

Note: Rift auto-provisions a TLS certificate via Let's Encrypt once the CNAME is pointing correctly. No manual certificate setup is needed.

Important: If you use Cloudflare, make sure the CNAME is set to DNS only (grey cloud), not Proxied. Rift needs to terminate TLS directly.