Fastly Domain-v1 Activation for Compute Services
Problem
After creating a custom domain with fastly domain-v1 create --fqdn example.com --service-id XXX,
the domain returns a 500 error: "Fastly error: unknown domain: example.com. Please check that
this domain has been added to a service." The edgecompute.app URL works fine.
Context / Trigger Conditions
- Classic domain API returns: "The classic domains APIs are deprecated. Please use the domain management API"
fastly domain-v1 create succeeds with domain-id and service-id- HTTP request to custom domain returns 500 "Domain Not Found"
- Checking domain via API shows
"activated": false, "verified": false
- The auto-generated edgecompute.app domain works correctly
Solution
Step 1: Create the domain (if not already done)
fastly domain-v1 create --fqdn example.com --service-id YOUR_SERVICE_ID
Step 2: Create TLS subscription for HTTPS
fastly tls-subscription create --domain example.com
Step 3: Get DNS configuration requirements
curl -s -H "Fastly-Key: $(fastly profile token)" \
"https://api.fastly.com/tls/subscriptions/SUBSCRIPTION_ID?include=tls_authorizations" | jq
Look for the challenges array in the response. You'll see options like:
managed-http-a: A records pointing to Fastly IPs (use for apex domains)managed-http-cname: CNAME to x.sni.global.fastly.net (use for subdomains)managed-dns: ACME challenge CNAME for _acme-challenge.example.com
Step 4: Configure DNS
For apex domains, add A records:
example.com → 151.101.1.242
example.com → 151.101.65.242
example.com → 151.101.129.242
example.com → 151.101.193.242
For subdomains, use CNAME:
www.example.com → x.sni.global.fastly.net
Step 5: Wait for automatic activation
Once DNS propagates, Fastly automatically:
- Verifies domain ownership via HTTP challenge
- Sets
verified: true
- Sets
activated: true
- Issues TLS certificate (state changes from "pending" to "issued")
This typically happens within 1-5 minutes after DNS propagation.
Step 6: Verify activation status
# Check domain status
curl -s -H "Fastly-Key: $(fastly profile token)" \
"https://api.fastly.com/domain-management/v1/domains/DOMAIN_ID" | jq
# Should show:
# "activated": true,
# "verified": true
# Check TLS status
fastly tls-subscription describe --id SUBSCRIPTION_ID
# State should be "issued"
Verification
# Test HTTP (should redirect to HTTPS)
curl -I http://example.com
# Expected: 308 Permanent Redirect to https://
# Test HTTPS
curl -s https://example.com | head -20
# Expected: Your site content
Example
# 1. Create KV store and link to service
fastly kv-store create --name my-content
fastly resource-link create --resource-id KV_STORE_ID --service-id SERVICE_ID --version latest --autoclone
# 2. Build and deploy
fastly compute publish
# 3. Add custom domain
fastly domain-v1 create --fqdn mysite.com --service-id SERVICE_ID
# Output: Created domain 'mysite.com' (domain-id: ABC123, service-id: XYZ789)
# 4. Set up TLS
fastly tls-subscription create --domain mysite.com
# Output: Created TLS Subscription 'SUB123' (Authority: certainly, Common Name: mysite.com)
# 5. Configure DNS with A records (apex) or CNAME (subdomain)
# 6. Wait ~2-5 minutes for verification
# 7. Site is live at https://mysite.com
Notes
- Post-September 2025: The
fastly domain create command (classic API) is deprecated. Use fastly domain-v1 instead.
- No manual activation: Unlike classic domains, domain-v1 domains activate automatically after DNS verification. There's no explicit "activate" API call.
- Service version independence: Domain-v1 creates "versionless domains" that aren't tied to a specific service version. You don't need to clone/activate versions to add domains.
- TLS is separate: Domain creation and TLS certificate management are separate operations. You can have a domain without TLS (HTTP only) but most setups want both.
- Fastly IPs are global: The A record IPs (151.101.x.242) are Fastly's anycast addresses and route to the nearest edge node.
References