# HTTPS URL Redirect using Fastly's host rewriting **URL:** \ **Category:** Writing, essays, and collections\ **Created:** [September 28, 2025, 2:52pm UTC](http://forum.0xdbfb7.com/t/https-url-redirect-using-fastlys-host-rewriting/350 "2025-09-28T14:52:53Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![0xDBFB7](http://forum.0xdbfb7.com/user_avatar/forum.0xdbfb7.com/0xdbfb7/32/7_2.png) [@0xDBFB7](http://forum.0xdbfb7.com/u/0xDBFB7)\ **Post date:** [September 28, 2025, 2:52pm UTC](http://forum.0xdbfb7.com/t/https-url-redirect-using-fastlys-host-rewriting/350/1 "2025-09-28T14:52:53Z")
I help with IT for a local group. They have a simple static website which (for legacy reasons) is running on Google Sites. However, the custom domain feature of Google Sites only allows you to use a _subdomain_, like `www.domain.com`, rather than a “naked domain”, `@`, “apex record”. ![image](http://forum.0xdbfb7.com/uploads/default/original/1X/aba3730018ff9a80d64d1ec6bc221d98888e21a8.png) Okay, fine. Now the first problem: anyone coming from a search engine will get sent to the right site, `https://www.domain.com` , but someone typing in the address into their search bar, `domain.com`, will get a _This site can’t be reached_. No worries, in the domain registrar’s DNS settings we’ll add a URL Redirect, from `@.domain` to `www.domain` . That works _some_ of the time, but causes a heisenbug. See, if the user’s browser first tries `https://domain.com`, as modern browsers are wont to do, it will not find anything there, because the domain registrar doesn’t attempt to process the redirect for HTTPS traffic. > [!note] **Possible alternative to all this mess:** > > There are two brand-new DNS record types, `SVCB` and `HTTPS`, the latter of which allows the apex domain to be redirected when used in Alias mode. Namecheap didn’t support these record types as of this date, and [browser support is somewhat limited.](https://kalfeher.com/https-current-state/) A solution would be some service that offers the browser an SSL Cert for the apex domain, and _then_ does the URL forward. I recently had this problem on another personal site that’s hosted with Apache2, and this technique worked great. > This is a feature that some domain registrars - specifically [EasyDNS](https://easydns.com/features/https-redirects/) - support - but this domain wasn’t hosted on one of them. Many recommendations online suggested using Cloudflare to make the redirect. This is a pretty reasonable solution, and I started setting it up - until the point where Cloudflare nonchalantly asked me to change the domain’s nameservers from the domain registrar’s to their own. ### Some sophistry So this is just how Cloudflare works. It’s a proxy, it’s a CDN, it’s [a sorta kind of MITM](http://cryto.net/~joepie91/blog/2016/07/14/cloudflare-we-have-a-problem/). There’s nothing wrong with this - but it gives me the heeby-jeebies. The web has an lasting undercurrent of this lovely peer-to-peer decentralized nature. I’m okay with pointing an A record at someone to get a redirect, but there’s something in the way CF takes ownership of your DNS that seems like something Cory Doctorow would get grumpy at me for. ### Fastly I made a new account under Fastly’s trial tier and added the apex domain to it (and put their A record IPs in the registrar’s DNS settings), and got them to create a certificate for it. Then I created a Service under that domain entry, with the Host: field set to `www.domain.com`. Fastly has a feature they call “apex redirect” which sounded promising, but I wasn’t able to figure out how to get it to do what I needed. ![s-blob-v1-IMAGE-9r-t20FFtaU](http://forum.0xdbfb7.com/uploads/default/original/1X/291b5b9cc5cc15d352bf417e61f381a712d283ed.png) No matter though, because what I really needed was their _ **Override Host** _ setting. ![s-blob-v1-IMAGE-iMF7WNITAKs](http://forum.0xdbfb7.com/uploads/default/original/1X/0c874e85982392a836c2611ca73c4c0baafce54c.png) Now everything works seamlessly.