Custom Domains

Hosting your checkout on your-store.naafipay.app works, but a custom domain like checkout.your-store.com looks more trustworthy and converts better. NaafiPay supports custom domains on every paid plan: you point a CNAME record at our edge, we provision a TLS certificate from Let's Encrypt within minutes, and your hosted checkout, Customer Portal, and receipt emails start using the new domain automatically. There is no extra fee, no NGINX configuration on your end, and certificates renew automatically forever.

Add a custom domain

In the dashboard go to Settings → Custom Domains → Add Domain and enter the hostname you want to use, for example checkout.your-store.com.
Copy the CNAME target NaafiPay shows you (it looks like edge-1234.naafipay-cdn.com).
In your DNS provider, create a CNAME record pointing your hostname to that target.
Wait two to five minutes, then click Verify in the dashboard.
Once verified, NaafiPay provisions a TLS certificate and starts serving traffic on the new hostname.

DNS check

1dig CNAME checkout.your-store.com +short
2# expected output:
3# edge-1234.naafipay-cdn.com.

TipApex domains (root domains)

DNS does not allow CNAME records at the apex (the root of a domain), so you cannot use your-store.com directly. Use a subdomain like checkout.your-store.com or pay.your-store.com instead. If you must serve checkout from the apex, use a DNS provider that supports ALIAS or ANAME records (Cloudflare, Route 53, DNSimple all support this).

What gets served on your domain

Once verified, the following surfaces are served from your custom hostname:

The hosted checkout page for every invoice and payment link
The customer portal (sign-in, payment history, subscription management)
The branded storefront listing page
Receipt and notification email “view in browser” links

Certificate lifecycle

NaafiPay issues a 90-day Let's Encrypt certificate the moment your DNS resolves correctly. We attempt renewal every 30 days and again every day from day 60 onward. If a renewal ever fails for more than 48 hours, we email every owner on the account and fall back to a wildcard NaafiPay certificate so checkout never breaks.

WarningDo not proxy through Cloudflare in Full mode

If your DNS provider is Cloudflare, set the CNAME record to DNS only (grey cloud), not proxied (orange cloud). Cloudflare's proxy terminates TLS with its own certificate, which prevents NaafiPay from issuing a certificate for the hostname and breaks the customer-facing TLS chain.

Removing a custom domain

From Settings → Custom Domains, click the trash icon next to the hostname. NaafiPay stops serving traffic on the domain within a minute. Your checkout continues to work on the default *.naafipay.app subdomain. You are responsible for removing the CNAME record from your DNS afterwards.