Enviera

For operations teams

Your own ops system, run by usTake the repetitive work off your team

For founders with a prototype

Take your prototype to production

For teams that need engineers

An engineer in your team while you hireAn extended dev team, month to month
How we build
Sign inBook a call

REPLIT CUSTOM DOMAINS

Replit custom domain works, but www doesn't

What you see

  • https://yourdomain.com opens your Replit app. https://www.yourdomain.com doesn't.
  • In Replit's Domains tool, only the apex (yourdomain.com) is listed, or www.yourdomain.com is listed but never verified, or shows Failed.
  • Your DNS records for these names are DNS only, or your DNS isn't on Cloudflare at all.

If your DNS is on Cloudflare with the proxy on (orange cloud) and www shows Error 525: SSL handshake failed, start with Error 525 on a Replit custom domain instead.

Why it happens

Replit treats www as just another subdomain. Its docs say: “www is a subdomain. Linking hat-tip.cc does not automatically serve www.hat-tip.cc.” [1]

To serve both names, Replit's docs say to add www “as a separate entry in the Domains tool” and publish the A and TXT records it generates on hostname www. Each subdomain “has its own TXT record, separate from the apex's”, and that replit-verify TXT record must stay in DNS permanently. [1] Replit doesn't issue wildcard certificates (*.yourdomain.com), so each subdomain has to be connected on its own. [2]

So if you only linked the apex, Replit has nothing set up for www: no entry, no verification, no certificate.

Four ways it goes wrong

  1. www was never added in the Domains tool. Linking the apex alone doesn't cover it. [1]
  2. The www records were created on host @. Replit can show the same values for the apex and www. On the Replit forum, one user saw Replit give the same values for the apex and www and couldn't add them; another user pointed out that the www records need hostname www, not @, and a later user confirmed that fixed it for them. [3]
  3. An old CNAME on www blocks the new record. In the same thread, the registrar refused the new record with “Record name www conflicts with another record”. The poster found the cause was an existing CNAME on www, and once that was dealt with, the record went in. [3] Replit only supports A records for your app's hostnames, so a CNAME on www has to go. [1]
  4. AAAA records or the Cloudflare proxy on www. Replit's docs say IPv6 (AAAA) records on the same hostname as your A record can block SSL, and that Cloudflare's proxy mode interferes with SSL provisioning. [2]

There is also a timing trap. Replit checks new records every 1 to 2 minutes for about 6 hours. If the www records aren't visible by then, the entry shows Failed and Replit stops checking. [1]

Step 1: Decide what www should do

You have two working setups:

  • A. Serve the app on both names. Both the apex and www are linked in Replit, each with its own records and certificate.
  • B. Serve the app on one name and redirect the other. Replit's docs note that most people who want a www address also set up a redirect from the apex to www (or the other way round) at their registrar. A name that only redirects doesn't need to be linked in Replit. [1]

We suggest B when you only need one address: it leaves Replit one certificate fewer to renew.

Step 2: Look at what DNS has for www now

Run these from a terminal (replace yourdomain.com):

dig +short www.yourdomain.com A
dig +short www.yourdomain.com AAAA
dig +short www.yourdomain.com CNAME
dig +short www.yourdomain.com TXT

+short prints only the answer. [4] Read it like this:

  • A: for setup A, it should be the IP Replit shows for the www entry. Nothing back means there is no A record on www.
  • AAAA: should be empty for a name Replit serves.
  • CNAME: should be empty for a name Replit serves. An old CNAME here will also stop you adding the A record.
  • TXT: for setup A, it should include the replit-verify=... value Replit shows for the www entry.

Step 3A: Serve www from Replit

  1. In Replit, open Domains and link www.yourdomain.com as its own entry, the same way you linked the apex.
  2. At your DNS provider, delete any CNAME and AAAA records on host www.
  3. Add the A record and the replit-verify TXT record Replit shows for the www entry, with hostname www, not @. Add both at the same time, as Replit's docs ask, so they're visible inside Replit's 6-hour checking window. [1]
  4. On Cloudflare, set the www record to DNS only (grey cloud). [2]
  5. Wait. DNS changes can take from a few minutes up to 48 hours to show up. Use Step 2 to confirm the records are visible. [1]
  6. If www shows Failed: check the records again with Step 2, then remove the www entry and add it again, once. Replit's docs say to retry a failed subdomain this way, one domain at a time, and not to remove and re-add domains that already work. [2] So leave the working apex alone. Each re-add requests a new certificate, and Let's Encrypt rate limits apply. [1]
  7. Keep the www TXT record for as long as you use the domain. Replit's docs say removing or changing it makes the next certificate renewal fail. [1]

Step 3B: Redirect one name to the other

  1. Pick the name your app is served on, and make sure it's linked in Replit with its records in place.
  2. Set up the redirect for the other name where your DNS lives:
    • At your registrar: Replit's docs point to registrar redirects. [1] Use a permanent (301) redirect.
    • On Cloudflare: create a Redirect Rule. Cloudflare's “Redirect from root to WWW” example matches https://example.com/* and sends it to https://www.example.com/${1} with status 301 and the query string preserved. [5] Its “Redirect from WWW to root” example does the reverse (https://www.* to https://${1}). [6] Cloudflare redirects only run on proxied records (“Single Redirects and Bulk Redirects require that you proxy the DNS records”), so the redirected name needs a DNS record set to Proxied (orange cloud). [7] That record just has to exist; the redirect answers before anything is sent to where it points. Keep the name Replit serves DNS only.
  3. Test the redirect: open the redirected name with https:// and check you land on the name your app is served on.
  4. Only then, if the redirected name is still linked in Replit's Domains tool, remove it there. Doing it in this order means the name doesn't go dark in between.

Step 4: Check both names

Open https://yourdomain.com and https://www.yourdomain.com. Both should reach your app, either directly or through the redirect. Then run the free checker below on your domain: it checks the apex and www together.

Not your case?

  • www is linked and verified, but the certificate has expired or www serves no certificate at all: that's a renewal problem, not a missing www entry. Replit's troubleshooting steps say to disconnect and reconnect the domain once (Publishing > Domains > Manage). [2] We saw www serve no certificate on a US marketplace site; our record of that incident doesn't show that www was unlinked, and what fixed it was one disconnect and reconnect.
  • www shows Cloudflare's Error 525: see Error 525 on a Replit custom domain.
  • The app itself is half-finished or broken beyond the domain: see Fix my Replit app.

Check your domain's www now (free)

Enter your domain and the checker looks at the apex and www together: whether www points anywhere, whether the two names point to different places, whether the replit-verify TXT is there, any AAAA records, whether the Cloudflare proxy is on, and the certificate each name presents (for names not behind the Cloudflare proxy).

Check my domain

Still stuck after one retry, or the domain is only one of the app's problems? Send it to us for a Rescue Audit.

Sources

  1. Replit Docs, "Custom domains"
  2. Replit Docs, "Custom domains and DNS" (help)
  3. Replit Community Forum, "A and TXT records are duplicating" (user posts, 2025-06-12 to 2026-04-01, not Replit staff)
  4. ISC, BIND 9 manual pages (dig)
  5. Cloudflare, "Redirect from root to WWW"
  6. Cloudflare, "Redirect from WWW to root"
  7. Cloudflare, "URL forwarding"