Custom domains

Serve a bucket's public files from your own hostname, such as files.example.com, over HTTPS.

A custom domain gives a bucket an address on your own domain. Instead of https://idr01.zata.ai/my-bucket/photo.jpg, people open https://files.example.com/photo.jpg. Zata issues and renews the HTTPS certificate for you.

Public link	Without a custom domain	With a custom domain
A file	https://idr01.zata.ai/my-bucket/photo.jpg	https://files.example.com/photo.jpg

Custom domains are for public downloads only. Uploads, listings and every S3 tool keep using the regional endpoint.

Files behind a custom domain are public: anyone who knows or guesses a file's name can download it without signing in, and the link does not expire. Downloads count towards your egress. Keep private files in another bucket.

Before you start

• A paid plan. Custom domains are not available on the free trial. See Billing.
• A subdomain you control, for example files.example.com or cdn.photos.example.com. You will add two DNS records for it, so you need access to the domain's DNS settings (at your registrar or DNS provider).
• The account owner's sign-in. Sub-users cannot add or remove custom domains.

What can't be used:

Not allowed	Why	Use instead
A root domain such as example.com	A root domain cannot have a CNAME record	A subdomain such as files.example.com
A wildcard such as *.example.com	Each hostname is verified on its own	One entry per hostname
An IP address or a hostname with a port	Only names work	A hostname
A hostname under zata.ai	Reserved	Your own domain

Each bucket can have 1 custom domain and each account 5, across all buckets. The Custom Domains section shows how many you have used. If you need more, raise a ticket.

Add a custom domain

Open the bucket's settings

Go to Buckets and select the gear icon (Bucket Settings) in the bucket's row, then open the Custom Domains section. See Bucket settings.

Allow public read access

If the bucket is not public yet, the section shows This bucket isn't publicly readable. Select Allow public read, tick Objects in this bucket become publicly readable, then confirm with Allow public read in the window.

This adds one access rule that lets anyone download files. Nobody else can list, upload, change or delete them, and your other access rules stay as they are. If you already turned on Public Access under Security & Access, nothing changes. See Make files public.

Enter the hostname

Select Add domain, type the hostname, for example files.example.com, and select Add domain. The domain appears with the status Pending verification and two DNS records to add.

Add the two DNS records

At your DNS provider, create the records exactly as shown. Each value has a Copy button.

Record	Name	Value	What it does
TXT	_zata-verify.files.example.com	zata-verify=… (shown in the console)	Proves you own the domain
CNAME	files.example.com	domains.zata.ai	Sends traffic to your bucket

Some DNS providers add your domain to the name by themselves. If yours does, enter only the part before it: _zata-verify.files and files.

If your DNS is on Cloudflare, set the CNAME record to DNS only (grey cloud), not Proxied. With the orange cloud on, the certificate cannot be issued and the domain stays in Pending DNS.

Wait for Active

Zata checks the records every minute. The status goes from Pending verification (TXT record found, ownership proved) to Pending DNS (CNAME found, certificate being issued) to Active. This usually takes a few minutes after the records are live; DNS changes can take longer to spread.

To check at once, select Check now. The button then waits 30 seconds before it can be used again.

Use the link

When the domain is Active, the section shows the Domain URL and an example file link. A file's link is the domain followed by the file's full name (its key):

https://files.example.com/path/to/photo.jpg

Opening the domain on its own does not list the bucket.

Once the domain is Active you can delete the TXT record. Keep the CNAME record for as long as you use the domain.

Statuses

Status	Meaning
Pending verification	Waiting for the TXT record. Nothing is served yet.
Pending DNS	Ownership proved. Waiting for the CNAME record and the HTTPS certificate.
Active	Files are served from the hostname over HTTPS.
Error	Something needs your attention. The message under the hostname says what.

A domain that stays pending for 7 days is marked Error with Verification timed out. Fix the records and select Check now to start again.

Fix a problem

The message under the hostname tells you what to do. The common ones:

Verification record not found yet

The TXT record isn't visible yet. DNS changes can take minutes, sometimes longer. Check the record name: it must be _zata-verify. followed by the full hostname. Zata keeps checking by itself.

Verification record doesn't match

A TXT record exists but holds a different value. Copy the value from the console again, without extra quotes or spaces, and replace the record.

CNAME record not found

Add a CNAME record for the hostname with the target domains.zata.ai. A hostname can have either a CNAME record or other records (A, AAAA, MX…), not both: remove any other records on that exact name.

Your CNAME record is proxied by Cloudflare

In Cloudflare's DNS settings, select the orange cloud next to the CNAME record so it turns grey (DNS only), save, then select Check now.

A CAA record is blocking the HTTPS certificate

Your domain has CAA records that don't allow Zata's certificate authorities. Add CAA records that allow letsencrypt.org and pki.goog, then select Check now. If you have no CAA records, this does not apply to you.

Another account verified this hostname first

Someone else proved ownership of this hostname before you did, so it cannot be connected to your bucket. Remove the entry. If you own the domain, raise a ticket.

The domain is Active but a link gives Access Denied

The bucket's files are not publicly readable. Open the Custom Domains section and select Allow public read, or check that a bucket policy is not blocking public reads. If the file was deleted, the link gives Not Found instead.

The domain is Active but a link gives a certificate error

The CNAME record was changed or removed after setup. Put it back (target domains.zata.ai, DNS only on Cloudflare) and select Check now.

Remove a custom domain

In the Custom Domains section, select Remove next to the hostname and confirm with Remove domain. Links on that hostname stop working at once. The files in the bucket are not affected. You can then delete the DNS records at your provider.

A custom domain is also removed when its bucket is deleted. If your account is suspended, custom domains stop serving files until the account is active again.

Good to know

• One hostname, one bucket. To point a second hostname at the same bucket, or the same hostname at another bucket, you need another entry, and the per-bucket limit applies.
• No path prefix. The domain serves the whole bucket. https://files.example.com/photo.jpg is the file photo.jpg at the top of the bucket.
• Region does not matter to visitors. The hostname works the same for a bucket in Indore or Mumbai.
• Allow public read covers every file. It is a bucket-level rule, so Make private on a single file does not hide that file from the custom domain. To stop serving a file, delete it or move it to a bucket without a custom domain.
• Turning public read off stops every custom domain of the bucket. When public read is on, the section shows Public read is on with a Turn off button. After you confirm, the domains stay set up but answer every request with Access Denied until you allow public read again. Turn off only removes the read-only rule that Allow public read created. If the bucket was made public another way, for example with Public Access in Security & Access, turn it off there.