Custom domains v2: bring-your-own with one-click TLS

Setting up a custom domain on LOAM used to be the bumpiest part of onboarding. Five copy-paste DNS records, a manual TLS provisioning step, then a separate edge cache config. Today's release collapses all of that into one screen.

The new flow

1. Paste your domain. We ask which registrar you're with — popular registrars (Cloudflare, Namecheap, GoDaddy, Porkbun) get a deeplink straight to the right DNS settings page; others get the records to add manually.
2. One DNS record. Just CNAME for the apex (or its workaround for registrars that don't support apex CNAME).
3. TLS auto-provisions through Let's Encrypt within ~30 seconds.
4. Edge caching activates automatically — no separate config.

Most merchants finish this in under two minutes.

What's under the hood

We migrated from per-domain TLS certificates to wildcard-rotated certs scoped to LOAM sub-zones, with merchant-domain certs issued via ACME on the edge. That removed the biggest source of provisioning failures — the cert-issuance race condition where DNS hadn't propagated by the time we asked for the cert.

We also moved cache invalidation from a long-tail batch job to edge-pushed invalidation, which means a content change shows up at all 300+ edge locations within ~250ms instead of the previous 30-second cache TTL.

Migration

If you're on the old flow, your domain keeps working. The next time you visit Settings → Domain you'll see a one-click "Upgrade to v2" prompt that handles the migration without downtime.