Documentation

DNS setup

How to make a hostname reach your Octic server - either by taking a label on a domain we operate, or by pointing a domain you already own at us.

Reading time: about 8 minutes · Last reviewed 18 September 2026

Two ways to attach a domain

Every server gets an address you can connect to immediately, but it is an address, not a name - and names are what players remember and what survive a node change. There are two ways to give a server a name.

  • Pooled subdomain. Pick a label and a base domain from the ones Octic operates - survival.octic.host. DNS is ours, so the record exists the moment you ask for it. No provider, no waiting, no propagation.
  • Your own domain. Point play.mybrand.com - or the apex, mybrand.com - at your server. You create the records at your own DNS provider; we verify them before serving traffic.

Both are configured in Dashboard → Custom Domains. You can attach more than one hostname to the same server, which is useful during a migration.

Pooled subdomains

The fast path. If you have no domain of your own, start here.

  1. Open Dashboard → Custom Domains → Add domain.
  2. Choose a base domain from the dropdown - this is the list an operator has published, typically octic.host.
  3. Type the label you want. The field shows the full hostname as you type, so there is no ambiguity about what you are claiming.
  4. Confirm. The record is live immediately - there is no verification step, because the zone is ours.

Connect with the hostname instead of the raw address, and share that with your players:

You pickYou getRecord created
survivalsurvival.octic.hostA record, managed by us
skyblock-2skyblock-2.octic.hostA record, managed by us

Labels follow the DNS rules, and all of them are enforced:

  • Lowercase letters, digits and hyphens only - no spaces, no underscores, no periods. Uppercase input is folded to lowercase rather than rejected.
  • Between 1 and 63 characters, and it may not begin or end with a hyphen.
  • Unique within its base domain. Labels are released when you remove the domain or delete the server.

A label on one of our domains belongs to the server that claimed it, not to you permanently. Keep an active server on it - see section 8 of our Terms of Service for the detail.

Reserved labels

Some labels are held back on every domain we operate. Knowing which, and why, saves a rejected form submission.

Reserved names fall into a few groups: infrastructure we serve ourselves (api, cdn, status), mail and DNS plumbing (mail, ns, postmaster), names that invite phishing when they sit next to our brand (login, billing, support), environments that imply a non-production status (staging, dev, beta), and game-adjacent names we keep for our own servers (play, mc, server).

A representative sample:

  • www
  • api
  • app
  • admin
  • dashboard
  • status
  • mail
  • smtp
  • abuse
  • ns
  • dns
  • auth
  • login
  • billing
  • docs
  • support
  • staging
  • dev
  • play
  • mc
  • server
  • ftp
  • ssh
  • discord
  • root
  • localhost

That is a sample, not the list. The full set is 129 names, and the API validates against all of them - the dashboard will tell you when a name is reserved and suggest something more specific. If you need one of these names, email support@octic.host with your use case; it is a policy decision, not a technical limit.

Custom subdomains

Attaching play.mybrand.com takes two DNS records, and the second one is not optional.

  1. Open Dashboard → Custom Domains → Add domain and enter the full hostname - play.mybrand.com, not mybrand.com.
  2. Octic generates a challenge token and shows you the two records to create, with a copy button on each value.
  3. Create both records at your DNS provider.
  4. Return to the dashboard and press Verify. Verification re-runs automatically for a while after that, so you do not have to sit on the page.
TypeNameValueTTL
CNAMEplaythe target host shown in your dashboard300
TXT_octic-challenge.play.mybrand.comthe octic-verify= token shown in your dashboard300

Verification polls DNS directly using the system resolver, so it honours your record’s TTL. A record you just created can take a few minutes - occasionally longer - to become visible to us even though a lookup on your own machine already succeeds, because your resolver may hold a negative answer for the domain. If you want to check from your side first:

Linux, macOS, and WSL
dig +short play.mybrand.com
dig +short TXT _octic-challenge.play.mybrand.com
Windows
nslookup play.mybrand.com
nslookup -type=TXT _octic-challenge.play.mybrand.com

Apex domains

mybrand.com works differently from play.mybrand.com, and it is the single most common reason a domain fails to attach.

A CNAME cannot exist at a zone apex. The DNS specification requires an apex to carry NS and SOA records, and a CNAME says “this name is an alias, look somewhere else” - so a CNAME at the apex would collide with records that must be there. Providers that allow it are flattening it behind your back, not making an exception.

So if you want mybrand.com itself to reach your server rather than play.mybrand.com, use your provider’s alias mechanism:

ProviderWhat to useNotes
CloudflareCNAME at the apexFlattening is automatic. Create the CNAME exactly as you would for a subdomain.
Route 53A record with AliasPoint the alias at the node's Elastic IP or its AWS resource. This is a Route 53 feature, not standard DNS - a plain CNAME at the apex will be rejected.
Namecheap, GoDaddy, and most othersALIAS or ANAMEThe name differs by provider. If your provider offers neither, point the apex at a redirect and use a subdomain instead.

Operators can change how automation behaves - see the DNS automation section of the deployment guide for the route53 and cloudflare provider configuration.

Cloudflare and the proxy

Verification still passes with the proxy enabled, so this is not something that will announce itself as an error. It shows up as players reporting worse ping than the server’s region suggests, and it is worth checking the cloud colour before you look anywhere else.

If you want Cloudflare in front of other parts of your brand - a website, a map renderer, a status page - that is a good fit for the proxy. Keep it off the hostname players connect to.

Troubleshooting

Four symptoms account for almost every DNS ticket. Work through the matching row before opening one.

SymptomLikely causeWhat to do
Domain stays PENDINGDNS was edited but has not propagated, or the resolver is still holding a negative answer from before the record existed.Wait out the record’s TTL - 300 seconds in the records we generate. Re-check from the dashboard rather than assuming failure; it shows the last check time. Do not re-create the records, which only restarts the clock.
Verification fails outrightOne of the two records is missing, or the TXT value differs from the token - a trailing space or a smart quote from copy-pasting is the usual culprit.Compare both records against the dashboard character for character. The CNAME must be on the hostname itself; the TXT must be on _octic-challenge.<hostname>, not on the hostname.
Players cannot connectThe domain is verified but the record is proxied, the server is stopped, or the game port is not open on both TCP and UDP.Check the cloud is grey. Start the server and confirm it reports healthy. Then test with the raw hostname and port from the dashboard - if that works, the problem is DNS, and if it does not, the problem is the server.
Connects, but the wrong IP showsTwo records exist for the same name - an old one at another provider, or a stale A record alongside the CNAME. Some resolvers return one, some the other.Query the name from two different networks and compare. A CNAME cannot coexist with any other record of the same name, so delete the other record and let the TTL expire.

If none of that fits, the dashboard’s domain row shows the last verification attempt and the error it produced. Include that, the hostname, and the output of dig +short <hostname> when you contact support@octic.host - it saves a round trip.