PRD: Seamless Domain Automation

From manual DNS to zero-click domain provisioning

NowPage • March 2026 • 6 Phases

Executive Summary

NowPage's domain provisioning currently automates 4 of 5 steps when a user adds a custom domain. The only remaining manual step is changing nameservers at the domain registrar. This PRD outlines the path to eliminating that final step, achieving fully automated domain setup where a user enters a domain name and it goes live in under 5 minutes with zero manual configuration.

Current State (Phase 1 + 2)

Step	Status	How
Cloudflare zone creation	Auto	POST /zones via CF API (Phase 2)
DNS records (A, CNAME, wildcard)	Auto	CF DNS API (Phase 1)
Vercel domain provisioning	Auto	Vercel API v10
Supabase database save	Auto	Direct insert
Nameserver change at registrar	Manual	User pastes 2 values at registrar

Key Files (Phase 1+2)

lib/dns/cloudflare.ts — createZone(), createDnsRecords(), getZoneId()
app/api/domains/route.ts — POST handler returns nameservers + zone status
app/api/domains/verify/route.ts — Auto-repair includes zone creation
components/DomainManager.tsx — UI shows nameservers with copy buttons

Environment Variables

CLOUDFLARE_API_TOKEN — Requires zone:read, zone:edit, DNS:edit, zone:create permissions
CLOUDFLARE_ACCOUNT_ID — Defaults to NowPage account
VERCEL_TOKEN — For domain provisioning on Vercel

Phase 3: Hostinger DNS API

Planned

For users who keep nameservers at Hostinger

Some users prefer to keep their nameservers at Hostinger rather than switching to Cloudflare. This phase adds direct DNS record creation via Hostinger's API, eliminating the need for Cloudflare in those cases.

Scope

New file: lib/dns/hostinger.ts with DNS record creation functions
Auto-add wildcard CNAME at Hostinger pointing to cname.vercel-dns.com
Preserve all existing DNS records (only add, never delete)
New env var: HOSTINGER_API_TOKEN
Update createDnsRecords() to try Cloudflare first, fall back to Hostinger

When This Helps

Users with existing Hostinger hosting who don't want to switch nameservers. Their root site stays on Hostinger, and we add a wildcard CNAME for NowPage subdomains directly in Hostinger's DNS.

Limitations

Still requires the user to have a Hostinger account. Only works for domains registered at or using Hostinger nameservers.

Phase 4: Namecheap API via VPS Proxy

Planned

Auto-set nameservers at Namecheap

Namecheap's API requires IP whitelisting, which doesn't work with Vercel's dynamic IPs. Solution: proxy API calls through the Forge VPS (178.156.253.142) which has a fixed IP that can be whitelisted.

Architecture

User clicks "Add Domain"
  → Vercel creates CF zone + DNS records
  → Vercel calls Forge VPS endpoint
  → VPS calls Namecheap API: domains.dns.setCustom
  → Nameservers changed automatically
  → Domain is live (zero manual steps)

Scope

New endpoint on Forge VPS: POST /api/namecheap/set-nameservers
Authenticated with shared secret between Vercel and VPS
Namecheap API: namecheap.domains.dns.setCustom method
New env vars: NAMECHEAP_API_USER, NAMECHEAP_API_KEY
VPS env: FORGE_API_SECRET for auth
New file: lib/dns/namecheap.ts (client that calls VPS proxy)

Impact

This phase fully eliminates the manual step for Namecheap domains. Combined with Phase 2 (Cloudflare zone creation), domains registered at Namecheap will go from "Add Domain" to "Live" with zero user intervention.

Prerequisites

Namecheap API access (requires 20+ domains or $50+ account balance)
IP whitelist: 178.156.253.142 (Forge VPS)
Forge VPS running and accessible

Phase 5: Per-User Credentials

Future

Each user brings their own API tokens

Currently, all domain operations use admin-level API tokens. This phase adds a credential vault where users can store their own Cloudflare, Hostinger, and Namecheap tokens. Their domains auto-configure using their own credentials.

Scope

Credential vault UI in dashboard settings
Encrypted storage in Supabase (AES-256 with per-user key)
Token validation on save (test API call to verify permissions)
Fallback chain: user token → admin token → manual instructions
Audit log: who used which token, when, for what domain

User Experience

Settings → Integrations → "Connect Cloudflare" / "Connect Namecheap" / "Connect Hostinger". One-time setup. After that, all their domains auto-configure using their own account.

Security Considerations

Tokens encrypted at rest, decrypted only during API calls
Scoped permissions: request minimum required (DNS edit, not full account access)
Token rotation reminders
Users can revoke at any time

Phase 6: Multi-Registrar Support

Future

Auto-detect registrar + universal API

Automatically detect which registrar a domain uses (via WHOIS) and route nameserver changes through the appropriate API. Covers the long tail of registrars.

Scope

GoDaddy API — already have MCP tool access; add lib/dns/godaddy.ts
Google Domains API — via Google Cloud DNS
Auto-detect registrar — WHOIS lookup to determine registrar, route to correct API
Universal adapter — lib/dns/adapter.ts with consistent interface across all registrars

Architecture

createDomain("mybrand.com")
  → whoisLookup("mybrand.com") → "namecheap"
  → adapter.setNameservers("namecheap", "mybrand.com", [...ns])
  → namecheap.setCustom("mybrand.com", [...ns])
  → done

End State Vision

User clicks "Add Domain" → enters "mybrand.com" →
  App auto-detects registrar (Namecheap) →
  Creates Cloudflare zone →
  Creates DNS records →
  Sets nameservers at Namecheap (via VPS proxy) →
  Adds to Vercel →
  Domain is LIVE in <5 minutes
  Zero manual steps.

Phase Summary

Phase	What	Status	Manual Steps After
1	Cloudflare DNS auto-config	Shipped	Nameservers + zone creation
2	Cloudflare zone auto-creation	Shipped	Nameservers only
3	Hostinger DNS API	Planned	Nameservers (unless Hostinger NS)
4	Namecheap API (VPS proxy)	Planned	None (for Namecheap)
5	Per-user credentials	Future	None (multi-user)
6	Multi-registrar auto-detect	Future	None (universal)

Dependencies & Risks

Technical Dependencies

Cloudflare API Token must include zone:create permission (updated in Phase 2)
Namecheap API requires 20+ domains or $50+ balance for access
Forge VPS (178.156.253.142) must be running for Phase 4 proxy
WHOIS API for Phase 6 registrar detection (rate limits may apply)

Risks

Registrar API changes: APIs may change without notice. Mitigation: graceful degradation to manual instructions.
Propagation delays: Even with automated nameserver changes, DNS propagation takes 1-24 hours. Users need clear expectations.
Credential security: Storing user API tokens requires strong encryption and access controls. Phase 5 must be implemented carefully.
Rate limits: Cloudflare free plan allows 1,200 API requests/5 min. Should be sufficient but monitor during growth.