Every app is reachable at an assigned hostname the moment it deploys. Attaching your own domain is two steps: tell uncloud about it, and point DNS at the ingress.

​
uncloud domain

All three take -app NAME to target an app outside the current directory.

​
The full flow

1

Attach the domain

The command prints the exact record because that is the part it cannot do for you. The app starts answering on the new name over HTTP immediately.
2

Create the DNS record

At your registrar or DNS provider, add the A record exactly as printed. Verify it before moving on:
3

Roll out to pick up the certificate

Certificates are issued over HTTP-01, which only works once the name resolves to the ingress — so issuance is attempted on deploy, and any name whose DNS has not landed is skipped and retried on the next one.
4

Confirm

HTTP now redirects to HTTPS, and the certificate covers both the custom domain and the app’s assigned hostname.

​
What happens underneath

A domain that has no certificate yet is still served, over plain HTTP, from its own routing block. This matters more than it looks: the ACME challenge that issues the certificate is itself served over port 80 on that hostname. Folding an uncertificated name into the redirect-to-HTTPS block would make it answer 404, which would in turn prevent the challenge that would have fixed it. Once a name is covered, it moves into the TLS block on the next rollout. One certificate covers the app’s assigned hostname and every custom domain attached to it, expanded in place rather than issued separately.

​
Removing a domain

The hostname stops being served straight away. The certificate is left alone — it is inert once nothing answers on that name, and deleting it would break the renewal bookkeeping for the names still on it.
Removing the last domain does not take the app offline: it still answers on its assigned hostname. To make an app unreachable from the internet entirely, give it an internal role instead.

​
Troubleshooting

DNS is not pointing at the ingress yet, or is pointing somewhere else. Compare dig +short your.domain against the address domain add printed. A CNAME at the apex will not work; use the A record.
The certificate has not been issued yet. Confirm DNS resolves, then run uncloud redeploy — issuance is attempted on every rollout and skipped silently while the name still does not resolve.
Check what is attached with uncloud domain list. A name in the list but not on the certificate is waiting for its next rollout after DNS landed.