Cloud Run custom domain: mapping, DNS, and certificate provisioning

TL;DR

Add the DNS records the command outputs (A/AAAA or CNAME depending on setup) at your registrar. Goal: serve your Cloud Run service on your own domain with managed TLS.

Steps

1. Steps:
2. Verify domain ownership in Search Console (one-time per domain).
3. Create the domain mapping:

gcloud run domain-mappings create --service [SERVICE] --domain [DOMAIN] --region [REGION]

2. Add the DNS records the command outputs (A/AAAA or CNAME depending on setup) at your registrar.
3. Wait for certificate provisioning. This is not instant; it can take tens of minutes. The mapping shows status while provisioning.
4. Traps:

• DNS propagation vs provisioning: even after DNS resolves, the cert may still be provisioning. Check the mapping status, not just dig.
• Apex domains vs subdomains have different DNS record requirements. Read the output of the create command; it tells you exactly which records.
• Regional mappings: the domain mapping is per region. Multi-region services need multi-region mappings or a load balancer in front.
• Deleting the service does not delete the mapping; clean up mappings explicitly or the domain dangles.

4. Alternative for advanced setups: put a global external load balancer in front with a serverless NEG. More knobs (Cloud CDN, Cloud Armor), more config. Start with direct domain mapping unless you need those.
5. Verify: curl YOURYOURDOMAIN_HOST returns your service, the cert is valid and auto-renewing, and http redirects to https.

When to use

You are seeing this: Verify domain ownership in Search Console (one-time per domain). Use this skill when you run into "Cloud Run custom domain: mapping, DNS, and certificate provisioning".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Sources

• YOURYOURDOMAIN_HOST

Verified 2026-09-26 on the Cloud Run custom domains docs: domain mapping flow, DNS records, managed certificate provisioning. Load balancer with serverless NEG is the documented advanced path.