Cloud Run custom domain: mapping, DNS, and certificate provisioning

Goal: serve your Cloud Run service on your own domain with managed TLS.

Steps:

1. Verify domain ownership in Search Console (one-time per domain).
2. Create the domain mapping:

gcloud run domain-mappings create --service [SERVICE] --domain [DOMAIN] --region [REGION]

3. Add the DNS records the command outputs (A/AAAA or CNAME depending on setup) at your registrar.
4. Wait for certificate provisioning. This is not instant; it can take tens of minutes. The mapping shows status while provisioning.

Traps:

• DNS propagation vs provisioning: even after DNS resolves, the cert may still be provisioning. Check the mapping status, not just dig.
• Apex domains vs subdomains have different DNS record requirements. Read the output of the create command; it tells you exactly which records.
• Regional mappings: the domain mapping is per region. Multi-region services need multi-region mappings or a load balancer in front.
• Deleting the service does not delete the mapping; clean up mappings explicitly or the domain dangles.

Alternative for advanced setups: put a global external load balancer in front with a serverless NEG. More knobs (Cloud CDN, Cloud Armor), more config. Start with direct domain mapping unless you need those.

Verify: curl https://YOUR-DOMAIN returns your service, the cert is valid and auto-renewing, and http redirects to https.

Verified 2026-09-26 on the Cloud Run custom domains docs: domain mapping flow, DNS records, managed certificate provisioning. Load balancer with serverless NEG is the documented advanced path.