Onboarding a domain

Before dids.lol will serve anything at a domain, you have to prove the domain is yours and point it here. Those are two different DNS records with two different jobs, and both must be in place.

Register first

Registering a domain claims it for your identity and hands back the exact records to create. Use the app, or call lol.dids.manage.register with any AT Protocol tool. The response contains a records array — create what it tells you, verbatim. Do not construct the records yourself from this page: the values are per-domain and per-identity, and the response is the authority.

A registration you never verify is released after 168 hours. The countdown starts when you register, and the domain becomes registrable by anyone again when it lapses.

The ownership record

A TXT record at _bard.<your domain> whose value is did=<your DID>. This is what proves the domain belongs to your identity rather than to someone else who happened to point their DNS at us.

If another DID's ownership TXT also resolves for the same domain, the registration is conflicted and neither party is served until exactly one remains. Remove the stale record.

The traffic record

Traffic goes to go.dids.lol.

On a subdomain — www.example.com, blog.example.com — that is an ordinary CNAME.

On an apex domain — example.com with nothing in front of it — a CNAME is not allowed by the DNS specification. Your provider will offer one of ALIAS, ANAME, or "CNAME flattening" instead; all three do the same thing, which is resolve the target and answer with its addresses. Use whichever your provider calls it. If your provider offers none of them, put the site on a subdomain and redirect the apex there at the registrar.

Verification

Verification checks three things: that the ownership TXT resolves and names your DID, that the traffic record points at go.dids.lol, and that no conflicting ownership record exists. You can ask for a re-check at most once every thirty seconds per domain; between requests the service re-checks on its own schedule, quickly at first and then more slowly.

Verification is continuous, not a one-time gate. If the records disappear later, the domain moves back out of the verified state and eventually stops being served.

The certificate

Once traffic reaches the edge, a certificate is obtained for your domain on the first request that needs one. There is nothing for you to do. It renews automatically, and it is revoked when you release the domain.

Why publishing waits

Validation works at any time — you can compose and check a record while DNS is still propagating. Publishing does not: the service will not serve a record for a domain that is not verified, and would reject it on arrival. The app disables the publish button and says why, which is a documented footgun turned into a disabled control.

Releasing a domain

Releasing is the opposite of registering: the site is deactivated, certificate authorization stops, the certificate is revoked, and the domain becomes registrable by anyone. It is not the same as deleting your site's content. Deleting the content leaves the registration, the DNS, and the certificate alone, and republishing restores service without re-verifying. Release when you are done with the domain; delete when you are done with the site.