# Domains

URL: /products/platform/domains · Id: `capability:domains`

> Domains connect names, DNS Records and certificates to a Startup’s Sites, Apps, Interfaces and Mailboxes, signed with DNSSEC by default.

[Domains](/business/nouns/domain) connect names, [DNS Records](/business/nouns/dns-record) and certificates to a [Startup](/business/nouns/startup)’s [Sites](/business/nouns/site), [Apps](/business/nouns/app), [Interfaces](/business/nouns/interface) and [Mailboxes](/business/nouns/mailbox), signed with DNSSEC by default. Every Startup answers at a claimed name from the moment it is created.

## Contract
| Clause | Terms |
| --- | --- |
| Starts | At creation, [`Domain.claim`](/business/nouns/domain/claim) gives the Startup a one-label name under an issuing [Domain](/business/nouns/domain) the public suffix list carries. |
| Acquires | [`Domain.register`](/business/nouns/domain/register) buys a name; [`Domain.connect`](/business/nouns/domain/connect) attaches one the Startup holds, proved by a TXT record. |
| Uses | `Domain.role` is `canonical`, `alias`, `redirect`, `preview`, `tenant`, `signIn` or `outreach`. A `redirect` forwards to `Domain.to`, path and query kept. |
| States | `Domain.state` runs from `candidate` to `released`. `verifying`, `live`, `degraded`, `expiring` and `lapsed` are observed, never set. |
| Records | Each answer is a DNS Record set through [`DNSRecord.set`](/business/nouns/dns-record/set). Records the platform writes refuse edits. |
| Certificates | Every serving Domain holds one, renewed through a CNAME that delegates validation (`Domain.validation`). A failed check moves the Domain to `degraded` through [`Domain.verify`](/business/nouns/domain/verify). |
| Spoofing | A Domain with no Mailbox publishes null SPF, DMARC `p=reject` and a null MX, written by [`Domain.register`](/business/nouns/domain/register). |
| [Customer](/business/nouns/customer) names | [`Domain.connect`](/business/nouns/domain/connect) with a `tenant` asks for a fresh ownership proof every time and refuses a wildcard name. |
| Payments | [`Domain.connect`](/business/nouns/domain/connect) registers each serving Domain with Stripe as a payment method domain; `Domain.walletsEnabled` records it. |
| Ends | [`Domain.release`](/business/nouns/domain/release) stops serving and keeps the record. It refuses a Domain whose `Domain.carriedIdentity` is true. |
| Test | In `test`, [`Domain.register`](/business/nouns/domain/register) simulates the purchase and spends nothing. |

## Verbs
| Verb | Object | Event |
| --- | --- | --- |
| [Domain.connect](/business/nouns/domain/connect) | [Domain](/business/nouns/domain) | [`Domain.connected`](/business/events/Domain.connected) |
| [Domain.claim](/business/nouns/domain/claim) | [Domain](/business/nouns/domain) | [`Domain.claimed`](/business/events/Domain.claimed) |
| [Domain.verify](/business/nouns/domain/verify) | [Domain](/business/nouns/domain) | [`Domain.verified`](/business/events/Domain.verified) |
| [Domain.release](/business/nouns/domain/release) | [Domain](/business/nouns/domain) | [`Domain.released`](/business/events/Domain.released) |
| [DNSRecord.set](/business/nouns/dns-record/set) | [DNS Record](/business/nouns/dns-record) | [`DNSRecord.set`](/business/events/DNSRecord.set) |

## Interfaces
- [API](/code/api/reference)
- [SDK](/code/sdk/reference)
- [CLI](/code/cli/reference)
- [MCP](/code/mcp/reference)

## Example
```text
fieldnotes.fm        canonical   Site, /docs, /portal, /api and /mcp
www.fieldnotes.fm    alias       renders in place
api.fieldnotes.fm    alias       the same API as /api
fieldnotes.co        redirect    permanent redirect; null SPF, DMARC reject, null MX
try-fieldnotes.com   outreach    cold mail only, apart from receipts
```