# Domains

Claim, verify, and bind a custom domain to a Ferrite application with automatic TLS.

Custom domains map a verified hostname to an application route. Ferrite keeps
domain ownership, DNS verification, route binding, and certificate lifecycle in
the platform control plane.

## Claim and verify

Open **Domains** in the Dashboard and enter `docs.example.com`, or call the MCP
`claim_domain` tool with that domain.

Add the returned DNS verification record, then run:

After publishing the returned record, use the Dashboard verification and app
binding controls. MCP clients use `verify_domain` with the presented token,
then `bind_domain` with the verified domain and app name.

The Gateway supports ACME certificate issuance and hot route-table reloads.
Verify the public TLS URL after binding; a successful DNS check alone does not
prove the app route or certificate is ready.

## Authentication domains

Give each authentication realm its own canonical HTTPS host. Do not path-mount
two identity realms beneath one cookie or WebAuthn RP-ID authority.

## Agent discovery

Generate sitemap, `llms.txt`, OpenAPI, agent card, and MCP URLs from the
canonical origin. A preview origin must not leak into production discovery
documents.

See [Agent-native Apps](/developers/agent-native-apps/) and
[Headers & Cookies](/developers/headers-cookies/).