CONNECTION GUIDE

Give your service
its own address.

Add your address to your hosting, then save its DNS target in banchi. Follow these steps from the compatibility check through testing sign-in and forms.

Last checked: September 6, 2026 · No sign-in needed

Check your hosting first

banchi provides a subdomain and its DNS connection settings. You supply the hosting or server that runs your website and APIs. With a standard DNS connection, visitors connect directly to that host.

GitHub Pages

Live connection and HTTPS verified

For static sites. Supports a custom domain and an optional GitHub verification TXT record. Server APIs need a separate host.

GitHub Pages instructions

Cloudflare Pages

Connection to another account verified

Add the custom domain on Pages first. Use the project's own pages.dev hostname as the DNS target.

Cloudflare Pages instructions

Other hosting and VPS

Vercel and Netlify verified; your own server (VPS) still untested

Supports A, AAAA and CNAME targets plus web verification TXT and CAA records. Your host must accept your address and provide HTTPS. Nameserver changes and email setup are outside the supported scope.

Vercel · Netlify · Your own server

Cloudflare Workers and R2

Not currently supported by standard setup

Worker custom domains require additional domain management permissions and configuration. Mado's operator-managed setup is not a general customer connection method. Contact us before purchasing.

Why Mado's setup differs

Hosting that advertises custom domains can still require different DNS records or a paid plan. Compare its requested settings with the supported records below. Ask us before purchasing if you are unsure.

Four steps to connect

  1. Publish your site on your hosting

    Check that the provider's default URL works. Confirm that your plan supports custom domains and find out which DNS records it requires.

  2. Register the address with your host

    Open Your addresses → address settings in banchi and copy the hostname. Add the full hostname under Custom domain on your hosting, without https:// or a path.

  3. Save the target in banchi

    Choose Connect to my own hosting. A hosting preset accepts one CNAME target or IPv4 address. For IPv6, multiple IP addresses, child names, TXT or CAA, use individual DNS records. Do not put paths or port numbers in DNS targets.

  4. Check HTTPS and app features

    Wait for your host to issue its certificate and run the banchi check again. Once connected, open your address and perform the app checks. Timing depends on the host and DNS caches.

banchi checks DNS and HTTPS. It distinguishes saved DNS, HTTPS reachability and a successful response at the root. Sign-in, posting and payments are not tested automatically.

Configure individual DNS records

Open individual DNS settings for your address and enter the type, name and value requested by your host. For an address such as your-name.banchi.app, use these name formats.

The rented address itself
Enter @ or your-name.banchi.app. This is the root of your rented address.
Names below your address
Enter the complete hostname, such as www.your-name.banchi.app, api.dev.your-name.banchi.app or _verify.your-name.banchi.app. Relative names such as www, another customer's address and wildcards such as *.your-name.banchi.app are not accepted.
A and AAAA
Enter the public IPv4 or IPv6 address supplied by your host. Multiple IP addresses at the same name are supported. Private-network and certain reserved addresses are not accepted.
CNAME
Enter the complete destination hostname. A CNAME cannot share its name with another record. For example, a root CNAME cannot coexist with a root TXT; verification would need a different name.
TXT
For web service ownership verification and DNS-01 certificate challenges. Email records such as SPF, DKIM and DMARC are outside the supported scope.
CAA
Use the certificate issuer settings requested by your host, for example 0 issue "letsencrypt.org". Match the actual issuer: an incorrect value can block certificate issuance or renewal.

The standard limit is five records per rented address. Verification TXT, CAA and banchi's automatic notice record all count. When no root A, AAAA or CNAME is set, banchi adds one notice record at the root, leaving four records for your settings. Adding your own root target automatically replaces the notice record; you do not edit that record yourself.

You may save a verification TXT first and add the hosting target afterward. You can also use child hostnames without publishing at the root. banchi's HTTPS diagnostic checks the root only: configure hostname acceptance, certificates and app features separately for every child hostname you use.

Automating certificate renewal with DNS-01

If your certificate issuer and ACME client support it, you can point a CNAME at _acme-challenge.your-name.banchi.app to a challenge name in DNS you control. This delegates the challenge response; it does not delegate the parent domain or your entire rented address through NS. A TXT and CNAME cannot coexist at that same name.

You operate TXT updates at the destination, protect its credentials and arrange automated renewal. End-to-end issuance and renewal using this method through banchi have not yet been demonstrated. Check the issuer's and client's current instructions. Let's Encrypt DNS-01 documentation

DNS_SAVED
No root hosting target is set, so there is no root HTTPS destination to test. Check each record's application status after saving TXT or other records. This is not confirmation of a published website.
HTTPS_REACHED
Root HTTPS responded with a status such as 401, 403, 404 or 405. Authentication or unsupported HEAD requests can cause this. Test the intended features in a browser.
LIVE
Root DNS matches and an HTTPS HEAD request returned 200–399. Redirect destinations, sign-in and posting have not been tested by this check.

Instructions for your hosting

GitHub Pages

  1. Enable publishing in your repository's Settings → Pages. GitHub Free requires a public repository. Review files and Git history for secrets before changing visibility.
  2. Enter your rented hostname under Custom domain.
  3. Choose GitHub Pages in banchi. Set Target value to username.github.io or organization.github.io. Do not append the repository path.
  4. For domain verification, request the record name and value for your rented hostname in the account or organization's Pages settings. Enter GitHub username (or organization) and Verification TXT value in banchi, keep the DNS target filled, and press Connect with this value. Once _github-pages-challenge-name.your-rented-hostname propagates, return to the account or organization's Pages settings and press Verify.
  5. When GitHub's DNS check and certificate issuance finish, enable Enforce HTTPS. Keep the verification TXT record after connecting.

Live example: Tsunagicho. We verified GitHub Pages, ownership verification, enforced HTTPS and browser interactions.

GitHub setup documentation · Domain verification

Cloudflare Pages

  1. Publish your Pages project and check its default project.pages.dev address.
  2. Open that project's Custom domains → Set up a custom domain and add your rented hostname. Do this before saving DNS in banchi.
  3. Choose Cloudflare Pages in banchi and save the CNAME target shown by Pages. banchi creates a DNS-only record.
  4. Wait for the domain to become active on Pages and check HTTPS. Run banchi's check again, then test any forms and APIs at the new address.

Add the hostname to the Pages project's custom domains. Do not try to add the rented subdomain as a separate Cloudflare site or zone.

Cloudflare Pages documentation

The three destinations below were checked against the provider's official instructions and banchi's input constraints. End-to-end connections from banchi have not been tested, so follow the records your provider actually displays. Nameserver changes, email records and setups exceeding the five-record limit cannot be configured as requested. Contact us with the requested record's name and type; do not send private keys or authentication tokens.

Vercel

Verified end to end on 2026-09-07 with a real Vercel project, through certificate issuance and removal

  1. Add your rented hostname under Settings → Domains in your Vercel project.
  2. Copy the CNAME target Vercel shows. It differs per project (for example ….vercel-dns-NNN.com); copy it exactly, to the last character.
  3. In banchi, choose "Vercel", paste it into the target value field and save with Connect with this value. Subdomains use CNAME only, never an IP address.
  4. Only if Vercel shows an ownership TXT record (_vercel.your-hostname), paste its value into the optional verification TXT field. banchi builds the record name. Skip this step if no TXT is shown.
  5. Wait for Vercel to issue the certificate, then run the banchi diagnosis again. If the diagnosis says the hostname is not added on Vercel, it may already be added and simply waiting on the certificate; wait a few minutes and check again.

Vercel: add a domain · Ownership TXT

Netlify

Verified end to end on 2026-09-07 with a real Netlify site, through certificate issuance and removal

  1. Add your rented hostname under Domain management → Add a domain you already own for your site. Netlify may warn that banchi.app is not owned by this account and suggest an optional root-level TXT record (subdomain-owner-verification). You can ignore both and continue.
  2. Copy the CNAME target Netlify gives you (your-site.netlify.app).
  3. In banchi, choose "Netlify", paste it into the target value field and save. Subdomains use CNAME only.
  4. Netlify issues and renews a Let's Encrypt certificate automatically. Nothing further is configured in banchi. Issuance can take a few minutes, during which banchi's diagnosis shows "Waiting for DNS propagation". Wait a few minutes, then check again.

Netlify: external DNS · Automatic HTTPS

Your own server (VPS)

Checked against official documentation only; end-to-end connection untested

  1. Configure your rented hostname in the web server's allowed hosts or virtual host.
  2. In banchi, choose "Other (CNAME / IPv4)" and paste your server's IPv4 address into the target value field. For IPv6, add an AAAA record in individual DNS records.
  3. Run Caddy or certbot on the server. If port 80 is reachable, HTTP-01 issues and renews the certificate automatically and banchi needs no extra setting.
  4. Only a wildcard certificate requires DNS-01. Add the _acme-challenge.your-hostname TXT record by hand in individual DNS records; its value must be replaced at every renewal.

Let's Encrypt challenge types · Caddy automatic HTTPS · certbot

Why do Workers, R2 and Mado need a different setup?

A standard Workers Custom Domain requires control of the relevant Cloudflare zone. A CNAME pointing at workers.dev alone does not configure the Worker to accept your rented hostname or provide its certificate.

R2's standard Custom Domain also requires a zone in the same Cloudflare account as the bucket. Changing a routing rule alone does not enable a customer in another account to register the hostname.

For Workers and R2 in the same Cloudflare zone, banchi's shared routing rule also runs first. Mado was connected through operator-managed routing, a map-data exception and an admin-path block. It is not counted as a standard customer connection.

Direct Workers and R2 connections are not available in the current interface. A general connection method is under investigation. URL redirection moves visitors to the destination URL; it does not keep the rented address in the browser.

Workers custom domain requirements · Routing priority · R2 public bucket requirements

App settings and tests before launch

A change of hostname can require app configuration changes. Check the items your service uses. These also apply when changing a regular custom domain.

Pages, images and APIs
Open and reload the home page and a deep link at the new address. Check public URLs, asset paths and API endpoints for old hostnames or HTTP links.
Sign-in
Update allowed URLs and OAuth callback URLs with your authentication provider. Test sign-in, reload and sign-out. Some providers require the full callback path to match.
Posting, forms and APIs on another host
Add only the required new origins to your app's Origin, CORS and CSRF settings. Submit a test and verify the saved result. Do not disable CORS checks globally.
Human verification, such as Turnstile
The widget owner must allow your rented hostname. Turnstile expects a hostname without a scheme or path. Avoid allowing the whole banchi.app parent, which includes other customers. Check the form at the new address.
Cookies and sessions
Omit the cookie's Domain attribute to scope it to your own host. Do not set it to banchi.app. Different rented addresses can still be considered same-site by browsers. Verify the request origin rather than relying only on SameSite. For __Host- cookies, set Secure; Path=/ and omit Domain.
WebSockets, video and files
If used, test connection, disconnection, reconnection, playback and any required partial downloads at the new address. A successful DNS check does not verify these features.
HTTPS and browsers
Check for certificate warnings, test on a phone and reload after important actions. Do not treat a launch as successful by bypassing certificate warnings.

Turnstile hostnames · CORS · Cookie scope

When something does not work

The address stays in Connecting

Compare the hostname registered at your host with the DNS target saved in banchi. Check your host's DNS validation and certificate status. Repeatedly deleting settings before propagation finishes can make diagnosis harder. Review the result, then check again.

DNS_SAVED means no root target is set. Responses such as 401 for required sign-in or 405 for unsupported HEAD can produce HTTPS_REACHED. Keep authentication enabled and compare the diagnostic states with actual browser behavior.

There is a certificate error or HTTPS does not open

Check that your host has issued a certificate for your rented hostname. Complete any required ownership verification and check the DNS name. Report a CAA diagnostic to banchi support.

Connected is shown, but sign-in or posting fails

Follow the app checks. Diagnostics check two DNS resolvers and an HTTPS HEAD response of 200–399 at the root. They do not follow redirects or operate forms, so app configuration can still be incomplete.

A different site, stale content or a banchi notice appears

Check the hosting project, domain registration and deployed version. DNS, hosting and browser caches can affect the result. For Workers and R2, review the current connection limitations.

I cannot find a TXT or nameserver field

Web verification TXT can be added in individual DNS settings; presets show fewer fields. NS changes and email setup such as MX, SPF, DKIM and DMARC are not offered. Before purchasing, compare the required types, names and number of records with the supported scope.

Still stuck? Use the bug report form. Include your hostname, hosting service, time, steps and diagnostic code. No GitHub account is required and reports are private. Do not include passwords, private keys, cookies or sign-in links.

Supported DNS and differences from owning a domain

Available records
A, AAAA, CNAME, web verification TXT and CAA at your rented name and multiple levels below it. The standard five-record limit includes automatic notice records. Your A/AAAA/CNAME targets are DNS-only; banchi does not proxy your site content. See individual DNS settings.
Not currently configurable
Email setup such as MX, SPF, DKIM and DMARC, NS delegation, wildcards and names outside your rented address. These are current banchi product limits, not prohibitions inherent to subdomains.
Ownership and continued use
You rent the subdomain for your contract period. This does not include ownership of the parent domain or a right to transfer the same name to another registrar. The parent domain's DNS, registration and reputation can have shared effects.
Email, certificates and browser boundaries
Email records such as MX are unavailable. Certificate issuance limits and same-site boundaries may be shared under the parent domain. Scope cookies and authentication permissions to your own hostname.
Traffic and protection
For standard connections, site traffic charges and attack handling depend on your hosting contract and configuration. banchi's fee does not include a server, unlimited destination traffic or destination attack protection.

Changing hosts, stopping renewal and leaving

When changing hosts, register the hostname on the new host first, then change banchi's target and verify it. Some traffic can still reach the old host while DNS changes propagate. Remove the old deployment after confirming the switch.

The price is ¥500 JPY per address per year, including tax. One email can own multiple addresses, with separate contracts and renewal dates. Use Stop auto-renewal for the chosen address and confirm in Stripe. The address remains usable through its paid period. Sales are limited to residents of Japan.

When ending use, first choose Stop connecting and go back to park in banchi and confirm that the connection DNS and TXT records have been removed and the change has propagated. Then remove the custom domain from your host and remove authentication URLs and Turnstile permissions. Removing the host registration first can let someone else claim it while your DNS still points there.

Separately remove the entry from your GitHub account or organization's Verified domains. If you cannot remove it or your banchi address is no longer editable, contact support before the address is rented again. Also contact us if you need to resume use.

See the terms for expiry and release timing

What we verified

Hosting services can change their requirements. If their instructions differ, check the current official documentation and required record types, then contact us if anything is unclear.