Skip to main content
A custom domain gives a hosted server a client-facing URL under a domain your organization controls. Horizon keeps the deployment behind that URL and manages the TLS certificate. Clients can then connect to https://mcp.example.com/mcp instead of the default fastmcp.app URL.
Custom domains are available on . You need permission to edit the server and control of the subdomain’s DNS records.
A custom domain points to the same production serving target as the server’s default URL. Promotion and rollback change the artifact behind both URLs together. Preview deployments cannot receive a custom domain, and a serving target can have one custom domain at a time.

​
Add a domain

1

Open domain settings

Open the hosted server, then select Settings and Domains. Select Add domain.
2

Choose the subdomain

Enter a fully qualified subdomain such as mcp.example.com. Horizon connects it to the production serving target and starts provisioning the domain and its TLS certificate.
3

Add DNS records

Copy both CNAME records shown by Horizon into your DNS provider. One record points the subdomain at Horizon. The other proves domain ownership so AWS Certificate Manager can issue the certificate.
4

Wait for verification

DNS changes can take time to propagate. Horizon checks the records while the domain shows Verification needed. Select Refresh after the records have propagated if the status has not updated.
5

Connect clients

When the status changes to Valid configuration, connect clients to https://<your-domain>/mcp. Authentication and authorization remain the same as on the default server URL.

​
DNS records

Horizon displays the exact names and values to enter. Keep both records in place while the domain is active because Horizon uses them for routing and certificate validation.

​
CAA records

CAA records restrict which certificate authorities can issue certificates. Most domains need no CAA change. For example, AWS Certificate Manager (ACM) can issue a certificate for mcp.example.com when example.com has no CAA records. If example.com only allows another certificate authority, add CAA 0 issue "amazontrust.com" alongside its existing CAA records. This lets ACM issue and renew the custom domain’s certificate. See the AWS guide to CAA errors for more information.
Custom domains use CNAME records and Horizon-managed certificates. An A record, a customer-supplied certificate, or a wildcard domain cannot replace this setup.

​
Domain states

An ACM certificate that reaches Failed cannot return to pending validation. If the displayed error says that certificate validation failed, contact horizon-support@prefect.io to restart the setup. For other errors, correct the reported issue and select Refresh.

​
Remove a domain

Removing a custom domain deletes its Horizon routing and managed certificate. Requests to that domain stop working immediately. The default Horizon server URL continues to route to the production deployment. Remove the DNS records after Horizon has removed the domain. Update MCP clients to another URL before removal so they do not lose access.

Deployments

Understand the production serving target behind a custom domain.

Connect a client

Configure MCP clients with a server URL and credential.