Configuring Ghost CMS Custom Publication Domains via DNS

Configuring a custom domain for Ghost CMS requires pointing your domain or subdomain to your Ghost hosting provider using standard DNS records, most commonly a CNAME or an A record. Getting this configuration right ensures your publication is secure, fast, and accessible to your readers without SSL errors or downtime. Whether you are launching a new publication on Ghost Pro or a self-hosted instance, understanding how DNS routing works is essential for a seamless setup.

Before updating your DNS provider, it is always a best practice to verify your current DNS state using the CNAME Lookup tool on XiaTools, which helps you quickly inspect existing routing rules and confirm whether records have propagated correctly across global nameservers.

Understanding Ghost CMS DNS Requirements

Ghost publications generally operate on either a root domain (e.g., example.com) or a subdomain (e.g., blog.example.com). The technical requirements for DNS differ depending on whether you are using a managed host like Ghost(Pro) or running your own stack on a cloud VPS.

Managed hosting providers typically require you to point a subdomain via a CNAME record, or point an apex domain using ALIAS, ANAME, or standard A records paired with TXT verification tokens. Because root domains (apex domains) do not technically support CNAME records per strict DNS specifications, many modern DNS providers offer proprietary flattening features to bridge this gap.

Record Types Explained

• CNAME Record: Maps an alias hostname (like blog.example.com) to your canonical destination hostname provided by your Ghost host (like my-publication.ghost.io).
• A Record: Points a hostname directly to an IPv4 address (such as 192.0.2.1).
• TXT Record: Used by hosts and certificate authorities to verify domain ownership and provision automated SSL/TLS certificates via Let's Encrypt.

Step-by-Step Ghost CMS CNAME Configuration

Follow these steps to configure your custom domain for a Ghost publication. Note that specific menu paths in your DNS registrar or Cloud DNS provider may vary slightly, but the fundamental record types and values remain identical.

Step 1: Gather Your Host Configuration Details

Log in to your Ghost administration dashboard or hosting control panel. Navigate to your custom domain settings to retrieve the target hostname provided by your host. For managed setups, this usually looks like a subdomain ending in your host's domain, such as your-site.ghost.io.

Step 2: Access Your DNS Management Console

Log into the registrar or DNS hosting provider where your domain is registered (such as Cloudflare, AWS Route 53, Namecheap, or Google Cloud DNS). Locate the DNS management, zone editor, or DNS records section for your domain.

Step 3: Create the CNAME Record

Add a new DNS record with the following parameters:

• Type: CNAME
• Name / Host: The subdomain you want to use (e.g., blog or www). If you are configuring just the subdomain part, enter only blog rather than blog.example.com.
• Value / Target / Points To: The canonical address provided by your Ghost host (e.g., your-site.ghost.io).
• TTL (Time to Live): Leave as Automatic or set to 3600 seconds.

If you are using a proxy service like Cloudflare, ensure that the proxy status is set correctly. Many managed Ghost hosts require the proxy to be disabled (DNS-only, grey cloud) during initial SSL certificate provisioning, after which it can be enabled.

Step 4: Add Domain Verification TXT Records

Most Ghost hosts require a TXT record to prove ownership of the domain before issuing an SSL certificate.

• Type: TXT
• Name / Host: _ghost or a specific verification hash provided by your host.
• Value: The long alphanumeric string generated by your Ghost dashboard.

Verifying Your DNS Configuration

Once your records are saved, you need to verify that they are propagating correctly across the internet. You can use command-line utilities to check your DNS records from your local terminal.

Using Dig

Run the following dig command to query the CNAME record for your Ghost publication:

dig CNAME blog.example.com +short

Expected sample output:

your-site.ghost.io.

Using Nslookup

Alternatively, use nslookup on Windows PowerShell or macOS terminal:

nslookup -type=CNAME blog.example.com

Sample output:

Server:  192.0.2.2
Address: 192.0.2.2#53

Non-authoritative answer:
blog.example.com	canonical name = your-site.ghost.io.

Checking SSL and HTTPS Response

After DNS propagation, verify that your site responds correctly over HTTPS using curl:

curl -I https://blog.example.com

Sample output:

HTTP/2 200 
date: Wed, 15 Oct 2025 07:00:00 GMT
content-type: text/html; charset=utf-8
server: Ghost

DNS Record Comparison for Ghost Setup

Setup Type	Record Type	Host / Name	Target / Value	Best Used For
Subdomain	CNAME	blog	site.ghost.io	Standard managed blogs
Root Domain	ALIAS / ANAME	@	site.ghost.io	Modern DNS supporting apex mapping
Root Domain	A Record	@	192.0.2.1	Self-hosted VPS instances
Verification	TXT	_ghost	ghost-verify-hash	SSL certificate provisioning

Common Mistakes and How to Fix Them

• CNAME on Apex Domain: Creating a CNAME record on the root domain (example.com) without DNS flattening breaks standard DNS compliance. Use an ALIAS record, ANAME record, or point a www CNAME with a redirect to the root.
• Trailing Dots: Entering your-site.ghost.io. with a trailing dot in interfaces that automatically append your zone name can result in double domains like your-site.ghost.io.example.com. Check your registrar's auto-append behavior.
• Cloudflare Proxy Conflicts: Leaving the orange cloud enabled in Cloudflare before Ghost provisions its Let's Encrypt SSL certificate often leads to 525 SSL Handshake Failed errors. Switch to grey cloud (DNS-only) until setup completes.
• Propagation Delays: Expecting instant updates. DNS changes can take anywhere from 5 minutes to 24 hours depending on your previous TTL settings and global ISP caching.

Quick Checklist for Ghost CNAME Setup

• Retrieved exact target URL from Ghost admin panel.
• Created CNAME record for your chosen subdomain pointing to the host.
• Added any required verification TXT records.
• Verified record resolution using dig or nslookup.
• Confirmed HTTPS is active and serving valid SSL certificates.