# FAQ > Short answers to common questions about connecting domains: which providers connect automatically, how records get written, whether keys are stored, and apex domains. Source: https://docs.customdomain.ai/docs/faq ### Which DNS providers connect automatically? Of the 217 providers in the census on 2026-10-31 (`GET /v1/providers/census`), 73 have an automatic path: * **6 sign in at the provider** (OAuth): Cloudflare, DigitalOcean, DNSimple, Netlify, Vercel and WordPress.com. * **1 applies our template with one-click setup** (Domain Connect): NameSilo. Glauca Digital and Domain Chief serve the same templates and are found through Domain Connect rather than listed in the census. * **66 take a scoped API key** the customer pastes once, among them Amazon Route 53, Google Cloud DNS, GoDaddy and Porkbun. One of the 66, PowerDNS, runs on its owner's own server, which the hosted service does not write to. The other 144 are connected by hand: the connect flow shows the exact records and checks them automatically. Any provider, automatic or not, can be connected that way. Namecheap is one of the 144. Its API opens only to accounts that qualify and replaces the whole zone on each write, so its records are added by hand by default. An account that qualifies can paste an API key instead, or use [secure sign-in](/docs/guides/secure-sign-in) where it is offered, which turns the API on for the account. Sign-in through Namecheap's MCP server is built but not switched on yet. See [Namecheap](/docs/providers/namecheap) and [Namecheap setup](/docs/dns/provider-setup#namecheap). See [Connection paths by provider](/docs/dns/providers) for which way each one connects and [Provider setup](/docs/dns/provider-setup) for per-provider credential steps and eligibility gates. ### Can I buy a new domain here too? Yes, under **Sell → Buy a domain** in the console. Checkout only *authorizes* your card; the domain is registered server-side, and the card is captured only after registration succeeds (a failure releases the hold, so you pay nothing). The purchased domain shows up in Domains already connected. See [Buying a domain](/docs/sell/buying-a-domain). ### How does a domain actually get configured? Through one of six [ways to connect](/docs/connect-flow/overview#the-four-rails): the customer signs in with their DNS provider via OAuth (records written with the sign-in's token, which the hosted service keeps, encrypted, at some providers), a one-click setup redirect, a [secure sign-in](/docs/guides/secure-sign-in) at a provider that offers no sign-in a third party can use, a scoped API key you pass once, the records added by hand (copy and paste, with automatic checking), or [DNS hosting](/docs/dns/managed-dns), where the owner points the domain's nameservers at CustomDomain™ once. `POST /v1/domains:check` tells you which are available for a given domain. ### Is my provider API key stored? Only if you keep **Remember this key** ticked when you connect in the console (through the API, only when you connect it as a [provider account](/docs/connect-flow/provider-accounts)). A kept key is encrypted at rest, puts your records back and removes them with the domain, and connects your other domains in one click; the plaintext never leaves the server, and you can revoke it any time on the console's **Connected accounts** page. Untick the box and the key is used once to write the records, then forgotten. Account passwords and tokens that expire within hours are never kept. See [Provider setup](/docs/dns/provider-setup#remembering-a-key-optional). ### Can I connect several domains on the same provider account at once? Yes, at providers whose API can list an account's domains, among them **Cloudflare, GoDaddy, Route 53 and Namecheap** (Namecheap for accounts that qualify for its API). After you apply a key to one domain, the console offers to list the account's other domains and connect them (all or a subset) in one step. See [Bulk connect](/docs/connect-flow/verify-and-go-live#bulk-connect-more-domains-on-one-account). ### Does it support apex domains as well as subdomains? Yes. A connection's `host` is empty for the apex or the subdomain label otherwise. A root domain works at **every** provider: where the provider has a root-CNAME type (ALIAS/ANAME/flattened CNAME: Cloudflare, DNSimple, Namecheap, Vercel…) the record set uses it; everywhere else (GoDaddy, Route 53, DigitalOcean, Name.com, OVH…) it uses `A` records pointing at our edge. `POST /v1/domains:check` returns `apex_supported` (the provider fact) and `apex_message` (set only when *this* record set can't be realized) so you can steer the customer. See [Root domains](/docs/dns/root-domains). ### Does it support wildcard domains? `POST /v1/domains:check` returns a `wildcard_support` flag per detected provider. Whether you offer wildcard in your product depends on how you use that flag in your onboarding flow. ### How long does DNS propagation usually take? For records written for the customer (a sign-in, one-click setup or an API key), usually seconds: the connection is checked every five seconds at first, and when public resolvers still hold an old or missing answer, we ask the zone's own nameservers. Records added by hand are verified as soon as the provider serves them, so the wait is mostly how long the customer takes. Some visitors can still reach the old host until a replaced record's TTL runs out. The connection sits in `propagating` (or `pending`, for records added by hand) until every desired record resolves; `GET /v1/connections/{id}` shows current status. ### What happens if I revoke or delete an API key? Revocation is immediate: a revoked key stops authenticating on its next request. Keys are never returned by list endpoints after creation; only metadata (`last4`, `created_at`, `revoked_at`) is visible. ### Can a connection lose its "live" status? The lifecycle is forward-only, so a `live` connection isn't demoted automatically. But [Monitor](/docs/webhooks/overview#event-catalog) detects when a live domain's records stop resolving and fires `domain.record_missing`, so you can react. See [Offboarding](/docs/connect-flow/offboarding). ### Is there a sandbox / test mode? Yes. A [test mode](/docs/guides/test-mode) application runs the whole connect flow, the widget, the API and your webhooks, on made up `.test` names such as `www.acme.test`, with a simulated DNS that decides how each one ends. The first part of the name picks the ending: any name goes live after about 15 seconds, `conflict.acme.test` stays pending as if another account had it, and `timeout.acme.test` fails after a minute. It needs no card and no real domain, it does not use up your free domains or your plan's allowance, it is never billed, and nothing is looked up or served. Make one with **Try test mode** in the console's application switcher, or `POST /v1/applications` with `"sandbox": true`. Test mode is a property of the application, not of the key. Applications and API keys also carry an environment (`production` / `staging` / `development`), and keys are prefixed `cd_test_` / `cd_live_` (keys created before that prefix change use `sk_test_` / `sk_live_` and keep working), but a `cd_test_` key made for a staging or development environment works on real domains.