You can use a domain you own to access subscriptions and files stored in Nodebuf. For example, a client's subscription URL can start with sub.example.com instead of the main website domain. The original Nodebuf resource still controls the content, account ownership and access key; the custom domain is an additional entry point.
The current service supports root domains and subdomains, using CNAME and TXT verification. Cloudflare records must use DNS-only mode, shown by the gray cloud. This article replaces the former orange-cloud advice and old management entry. Existing users should verify their original domain record again; see the custom domain migration guide for the transition steps.
1. Choose a hostname without disrupting existing services
Sign in on the main website and open Custom domains in your account. Add a domain whose DNS you control. Enter only a hostname such as sub.example.com, without https://, a port, path or subscription secret.
A root domain such as example.com also works. If it already hosts a website or email service, prefer a dedicated subscription subdomain. Do not delete an existing domain record, subscription or file just to migrate. Open the existing domain card and use the DNS instructions it currently shows.
2. Add the CNAME and TXT records
Both examples below assume you are editing the example.com DNS zone. Choose one set. Copy the TXT value from your own domain card, not from another user's screenshot.
For the subdomain sub.example.com
| Type | Common DNS Name field | Full record name | Value or target |
|---|---|---|---|
| CNAME | sub |
sub.example.com |
ingress.nodebuf.com, DNS only / gray cloud |
| TXT | _nodebuf.sub |
_nodebuf.sub.example.com |
Copy from this domain's Nodebuf card |
For the root domain example.com
| Type | Common DNS Name field | Full record name | Value or target |
|---|---|---|---|
| CNAME | @ |
example.com |
ingress.nodebuf.com, DNS only / gray cloud |
| TXT | _nodebuf |
_nodebuf.example.com |
Copy from this root domain's Nodebuf card |
Some providers require a full name; others add the zone suffix for you. Check the saved full name so you do not create sub.example.com.example.com. The root domain and subdomain use different TXT records and their verification values are not interchangeable.
If the subscription hostname already has an A, AAAA or CNAME record, note its old value before resolving the conflict. Change only the hostname you are connecting. Do not remove email records or unrelated website records. The TXT record uses a separate _nodebuf name, so it does not share the subscription hostname's CNAME record.
Why Cloudflare must use the gray cloud
The current service uses ingress.nodebuf.com to serve subscriptions and manage certificates directly. It does not use Cloudflare SaaS custom hostnames. An orange-cloud record returns Cloudflare proxy addresses and can prevent verification. Change the subscription record to DNS only; other websites can keep their existing orange-cloud configuration.
At the root domain, Cloudflare normally flattens a CNAME into its final IP addresses. An empty CNAME lookup alone does not mean you entered the record incorrectly. Nodebuf checks your exact TXT proof and compares the complete public A/AAAA address sets for your domain and the fixed gateway. One matching IP is not sufficient: extra old IPv6 records, an incorrect target or failed resolution still need attention. See Cloudflare's root-domain flattening documentation.
Keep the target set to the ingress.nodebuf.com value shown by Nodebuf rather than replacing it with an IP from a lookup. You do not need to provide a Cloudflare API token or set up a Tunnel.
3. Verify DNS and wait for HTTPS
Return to the corresponding Nodebuf domain card and choose Verify DNS and HTTPS. Ownership and routing are checked first, then the service prepares the certificate. Successful DNS verification does not mean HTTPS is ready yet. Wait until the card says the domain is usable before copying its links into clients.
DNS caches, certificate authority validation and network conditions can affect how long this takes. Keep the CNAME and TXT records while the certificate is being prepared, then refresh the status. Do not disable client certificate verification to work around the wait.
Nodebuf's gateway requests and renews the certificate. You do not need another VPS or a certificate installed on your computer. HTTP-01 validation requires the gateway's public port 80 to be reachable; this is managed by the website operator, not a request to open your home router. See Let's Encrypt's challenge documentation.
4. Copy the complete link into your client
Once the domain is ready, open your dynamic subscription, file or site short link, select the custom domain in its link dialog, and copy the resulting full URL. The following illustrates the structure only; it is not a working subscription:
Main site: https://nodebuf.com/dynamic?path=YOUR_PATH&security=YOUR_SECRET&type=mihomo
Custom: https://sub.example.com/dynamic?path=YOUR_PATH&security=YOUR_SECRET&type=mihomo
Only the origin changes. Keep the original path and every query parameter. File IDs and tokens, repository forwarding signatures and short-link codes must also stay intact. Prefer the link generated by the page over assembling one from memory.
Update one client first, check the expected format and node count, then move the other devices. Connecting a domain does not automatically edit URLs already saved in clients, or remove expiry, device or access restrictions. Keep the original main-site link privately as a fallback.
Which links are supported?
| Supported through your custom domain | Keep using the original site |
|---|---|
| Dynamic subscriptions owned by your account | Homepage, articles, tools, login and administration |
| Your user-file and public-file links | Files or subscriptions owned by another account |
| Your repository forwarding subscriptions | Temporary shares without durable account ownership |
| Your site short links | Third-party tt.vg short links |
If opening https://sub.example.com/ shows a subscription-only notice, that explains the domain's scope. It is not a mirror of the whole website and does not provide a login page. Use the complete subscription path and parameters instead.
Troubleshoot by the stage that failed
| What you see | What to check first |
|---|---|
| TXT mismatch | The full name is _nodebuf.YOUR_SUBSCRIPTION_DOMAIN, and the value comes from this account's current domain card |
| CNAME or gateway mismatch | The target is ingress.nodebuf.com, Cloudflare is DNS only, and no stale A/AAAA answers or caches remain |
| No CNAME answer for a root domain | Do not enable the orange cloud to fix this; check TXT and complete A/AAAA answers because normal flattening is supported |
| DNS verified but HTTPS pending | Keep the records and refresh certificate status; if it continues failing, send the domain and redacted error to site support |
| HTTPS works but a subscription is refused | Check the complete path, key, ownership, expiry and device limit; compare the original main-site link to separate domain and resource problems |
Keep TXT and CNAME records after setup because the service continues to recheck them. If you no longer need the domain, remove its binding on the main website. This does not delete the original subscriptions or files, but clients must switch to an available original link. Full URLs may carry access credentials: redact keys and tokens before requesting help, and never post them in public comments.