# Domains

> Attach custom domains to a service, verify DNS, and get managed TLS.

Every service gets a generated URL. Custom domains attach per service and environment, from the Domains tab of the [inspector](/docs/control-plane) or the CLI.

## Attach a domain

```bash
yalla domains add app.example.com --service api --env production
```

## Verify DNS

The add command prints the DNS records to create. Check verification status at any time:

```bash
yalla domains list --service api --env production
```

## TLS certificates

Certificates are issued and renewed automatically once DNS verifies. Yalla never asks you to paste private keys into the CLI or the browser.

> [!WARNING]
> Removing a domain takes its traffic offline immediately. The CLI requires explicit confirmation before it proceeds.