Documentation

🪶 Overview

Fioness is a free subdomain service running on Cloudflare Workers. Claim up to 3 subdomains on shi-n.ing and point them using any standard DNS record type — no account required.

• Free forever — 3 subdomains per account, no payment required
• Instant activation — live in under a second
• Full DNS support — A, AAAA, CNAME, MX, SPF, DKIM, DMARC, TXT, CAA, SRV, NS, PTR and more
• Secure — HSTS mandatory for .ing TLDs, optional TOTP 2FA on accounts
• Anonymous-first — claim without an account, link to one later

Claiming a Subdomain

Visit get.shi-n.ing to claim. No account needed.

DNS Record Types — Quick Reference

All DNS record type information is sourced from Cloudflare's DNS documentation. Each record has a maximum wire-format size of 4,096 bytes (RFC 1035). Multiple records with the same name and type must not exceed 8,192 characters combined.

A & AAAA Records

A records map a name to one or more IPv4 addresses. AAAA records map to IPv6. These are the only record types that can be proxied through Cloudflare's CDN.

Example

CNAME Records

CNAME (Canonical Name) records alias one domain name to another. The final target in the chain must resolve to a valid A or AAAA record. Queries for other record types on the same name are not supported when using CNAME.

Cloudflare uses CNAME flattening to resolve the chain at the edge, returning the final IP directly — improving performance and enabling CNAME at the zone apex.

Example

MX Records

A Mail Exchange (MX) record specifies which mail server is responsible for accepting email for a domain. Without an MX record, email to that domain cannot be delivered.

Example

Email Authentication: SPF, DKIM, DMARC

These three records work together to prove email is legitimate and prevent your domain being used for spoofing. They are recommended even for domains that never send email — set restrictive values to block abuse.

SPF — Sender Policy Framework

Lists IP addresses and services authorised to send email on behalf of your domain. Receiving servers check this before accepting a message.

DKIM — DomainKeys Identified Mail

Uses a public/private key pair. The private key signs outgoing email on your mail server; the public key is published in DNS so receivers can verify the signature.

DMARC — Domain-based Message Authentication

Instructs receiving mail servers what to do when SPF or DKIM checks fail, and where to send aggregate reports.

v=DMARC1; p=reject; rua=mailto:dmarc@mysite.com; adkim=s; aspf=s

TXT Records

TXT (text) records store arbitrary text strings in DNS. They are commonly used for domain ownership verification before issuing SSL certificates, and as the underlying format for SPF, DKIM, and DMARC.

Content is one or more text strings in double quotes. Cloudflare adds quotes automatically if omitted when creating the record.

Example

CAA Records

Certificate Authority Authorization (CAA) records specify which CAs may issue SSL/TLS certificates for your domain. This prevents rogue or misissued certificates.

0 issue "letsencrypt.org"
0 issuewild "sectigo.com"
0 iodef "mailto:security@mysite.com"

SRV Records

Service (SRV) records specify the hostname and port for specific services such as SIP (VOIP), XMPP (messaging), and others that need DNS-based service discovery.

Record names use the format _service._proto.name (e.g. _xmpp._tcp.you.shi-n.ing). SRV records cannot be proxied.

In the Fioness value field, enter as: priority weight port hostname

10 5 5060 sip.mysite.com

SVCB & HTTPS Records

Service Binding (SVCB) and HTTPS records let a client learn upfront how to connect to a server — including whether to use HTTP/2 or HTTP/3 — without an initial plaintext connection. This reduces latency and improves security.

If your domain has HTTP/2 or HTTP/3 enabled with Cloudflare's Universal SSL and proxied DNS records, Cloudflare generates HTTPS records automatically. You do not need to add them manually in most cases.

NS Records

Nameserver (NS) records indicate which DNS server is authoritative for a zone or subdomain. You only need to add NS records when delegating a subdomain to a different DNS provider than the parent zone.

Example (subdomain delegation)

PTR Records

Pointer (PTR) records map an IP address back to a hostname — the reverse of an A record. They live in reverse DNS zones (in-addr.arpa for IPv4, ip6.arpa for IPv6) and are used for reverse lookups (e.g. mail server identity checks).

PTR records are typically controlled by your hosting provider. You can use them in Fioness if you manage the reverse zone for your IP block.

Example

SOA Records

The Start of Authority (SOA) record stores zone metadata: primary nameserver, admin email address, serial number, and cache TTLs. Every DNS zone has exactly one SOA record.

If you use Cloudflare as your authoritative DNS, you do not need to create an SOA record — Cloudflare creates and maintains it automatically when you add the zone to your account.

DNSSEC — DS & DNSKEY Records

DNSSEC uses cryptographic signatures to ensure DNS responses are authentic and tamper-proof. It creates a verifiable chain of trust from the root DNS servers down to individual records in your zone.

• DNSKEY records — public cryptographic keys stored in your zone, used to verify signed records.
• DS records — delegation signer records stored at the parent TLD registry, establishing the chain of trust from the parent to your zone.

How It Works

Cloudflare's wildcard DNS record catches all *.shi-n.ing requests and routes them to the Worker before reaching any origin.

Browser → Cloudflare Edge → Worker
                                 ↓
                    KV lookup: subdomain:yourname
                                 ↓
                    ┌────────────┴────────────┐
                    │                         │
               Record found             Not found
               Reverse proxy →         → 404 page
               target destination

The Worker injects HSTS headers on every response (mandatory for .ing TLDs on the HSTS preload list) and forwards the full URL path and query string to your configured target.

Domain Verification

After claiming, Fioness provides a TXT token you can add to your own DNS to prove you control the target. Add it at your DNS provider:

Verification is optional but may be required for future features such as custom certificates.

Accounts

Claim anonymously with a browser token, or create an account to manage subdomains across devices. Account features:

• Manage subdomains from any device or browser
• Receive email confirmations and password reset links
• Enable TOTP two-factor authentication
• Same 3-subdomain limit as anonymous users

Passwords are hashed (SHA-256 + email salt) before storage. Sessions are 30-day bearer tokens in localStorage.

Two-Factor Authentication

TOTP-based 2FA per RFC 6238 — works with Google Authenticator, Authy, 1Password, Bitwarden, and any TOTP app.

Blocked Subdomain Names

Certain names are blocked to prevent abuse:

• Reserved (www, mail, api, get, etc.) — infrastructure. Cannot be claimed.
• Brand / scam-risk (dhl, amazon, paypal, etc.) — visitors are redirected to get.shi-n.ing to prevent phishing.

To suggest an addition, contact hi@shi-n.ing.