Custom Domains for Workers: DNS-Native Routing Without the Certificates

Cloudflare has launched Custom Domains for Workers in Open Beta. The feature lets developers attach a hostname directly to a Worker, with Cloudflare handling the DNS record and certificate provisioning automatically. Instead of configuring routes with wildcard patterns or managing TLS, you add a domain in the dashboard and the Worker becomes the origin—no origin server or route configuration required.

How it works

Custom Domains leverage Cloudflare DNS under the hood. When you add a domain to a Worker, Cloudflare creates the necessary DNS record and issues a certificate for that hostname. The Worker is registered as the origin, so incoming traffic is routed to it based on the DNS record rather than through a separate routing table. The flow is designed to be transparent: when you add a Custom Domain, you're guided through creating the required records, including replacing any that already exist for that hostname.

Once a Custom Domain is attached, two notable behavior changes come into play:

  • All paths are handled: Requests to any path on the Custom Domain invoke the Worker. There's no need to add a route with /* to cover the whole domain.
  • The Worker is the origin: Inside the Worker, you don't need to call fetch(event.request) to talk to your own Worker. The request arrives directly, and you can issue outbound requests to internal or external services by creating your own request objects. Using the Unbound usage model, the limit for external requests is now 1,000.

Because Custom Domain Workers act as origin servers, they can also be called directly from other Workers. A simple fetch request to the Custom Domain endpoint will trigger the Worker, even if the target is on the same Cloudflare zone. That removes the need for additional routing logic or separate bindings when you need to invoke the Worker elsewhere.

A practical example: an API gateway

To illustrate usage, consider a Worker named api-gateway. It inspects the incoming request path and delegates work to downstream Workers using Service Bindings. Privileged endpoints go through an authorization check before execution. Once that application is ready, you attach a Custom Domain by navigating to the Worker's Triggers tab, clicking Add Custom Domain, and entering the hostname. The dashboard walks you through the rest, and the DNS record is generated with the Worker as its target.

Benefits come from the DNS-based routing model: since requests resolve directly to the Worker via DNS, there's no need to search through a routing table to find the right worker. Combined with Service Bindings, you can route to multiple downstream Workers based on URL parameters, headers, request content, or query strings—making Custom Domains a flexible entry point for larger Worker-based architectures.

Custom Domains are available now in Open Beta. The feature is supported in the Cloudflare Dashboard and through the API, with Wrangler CLI support expected soon.