Wildcard domain / subdomain routing

Sending every customer subdomain to one deployment, then using the hostname to decide which customer's site to show.

“one app for every customer subdomain”“make anything before my domain work”“how do I serve username.example.com”“customer name in the URL”“catch all subdomains”“star dot domain”“wildard subdomain”“give every customer their own web address automatically”“like how every Slack team gets its own URL”

See it

Live demo coming soon

What it is

Wildcard domain routing lets one deployment answer for many names such as acme.example.com and orbit.example.com. A wildcard DNS record like *.example.com sends those names to the same front door, then the app or reverse proxy reads the Host header to choose the right tenant.

You have used this all day without naming it: acme.slack.com, yourshop.myshopify.com, and every generated vercel.app preview URL are the same trick. Reach for it in multi-tenant products where each customer gets a branded subdomain without a new deployment or DNS record, and for short-lived preview environments.

The one-label rule belongs to TLS, not DNS. A wildcard certificate for *.example.com covers acme.example.com but not api.acme.example.com, while a wildcard DNS record can still answer for the deeper name unless a closer record exists. The application must also reject unknown or unclaimed tenant names instead of serving the wrong account.

Ask AI for it

Set up multi-tenant subdomain routing with a Cloudflare DNS wildcard record for *.example.com and a Let's Encrypt wildcard certificate issued through the DNS-01 challenge. In the application, normalize and validate the Host header, look up the first label as the tenant slug, return 404 for unknown tenants, and reserve www and api so they cannot be claimed.

You might have meant

dns recordstls certificate tls terminationreverse proxyrewrite vs redirectorigin server