Bedrock domains

A Bedrock domain is a hostname your players type to join your server through Geyser — for example bedrock.example.com. For each Bedrock domain, Infinity-Filter creates a certificate (Let’s Encrypt), renews it automatically, and serves it on your dedicated IP. You don’t install anything on your server.

Where to find it

Open Network → Domains. The Bedrock domains section sits under the Java domains table. It’s shown when your network has a dedicated IP and Geyser backends using NetherNet.

The section shows:

• The number of Bedrock domains used, out of 20.
• DNS setup — the hostname your domains must point to (your dedicated IP hostname, {uid}.ip.infinity-filter.com). Click the field to copy it.
• Your Bedrock domains, each with its certificate status.
• Add a domain, and Validate again when a domain isn’t registered yet.
• A refresh button (top right) to reload the certificate statuses.

Before you add a domain: the CNAME

The domain must already point to your tunnel when you add it. At your DNS provider, create a CNAME record from your Bedrock domain to the hostname shown in DNS setup:

bedrock.example.com.   300   IN   CNAME   {uid}.ip.infinity-filter.com.

Then check that the record is visible (it usually takes a minute or two):

Use a CNAME to the hostname, not an A record to the IP: if your dedicated IP ever changes, the hostname follows automatically and your domain keeps working without any change on your side.

Adding a domain

Click Add a domain, type the domain and click Add.

Infinity-Filter then:

1. 1

   Checks the format

   A plain domain name: no IP, no http://, no port. Uppercase letters and a trailing dot are fine.

2. 2

   Checks the domain is free

   A domain used by a network of another account is refused. Your own networks can share it.

3. 3

   Checks the DNS

   The domain must point to your tunnel (the CNAME above).

4. 4

   Creates the certificate

   Usually a few seconds. The domain then shows Active, with the certificate's expiry date.

When the DNS isn’t ready yet

If the domain doesn’t point to your tunnel yet, nothing is saved and the dialog shows the record to create:

The message tells you what the DNS returns today:

Certificate statuses

Validate again

A domain can be saved on your network without being registered for a certificate yet — for example after your dedicated IP was renewed or replaced, or when its DNS was wrong at that moment. It then shows Not registered, and a Validate again button appears:

Fix the DNS, then click Validate again. Infinity-Filter sends the domains again: those whose DNS is right get their certificate, the others show what’s wrong and which record to create.

Infinity-Filter also retries on its own when your Geyser routes come back (new dedicated IP, network reactivated…).

Renewal

Certificates are renewed automatically, 30 days before they expire. Keep the CNAME in place: if the domain stops pointing to your tunnel, the renewal fails and the domain shows DNS error until you fix it.

Wildcard domains

A wildcard such as *.example.com gives one certificate to every direct subdomain (play.example.com, eu.example.com…). It needs the wildcard domain option of your plan, and two DNS records, created once:

; Players land on your tunnel.
*.example.com.                300   IN   CNAME   {uid}.ip.infinity-filter.com.

; Lets Infinity-Filter validate and renew the wildcard certificate for you.
_acme-challenge.example.com.  300   IN   CNAME   {id}.acme.infinity-filter.com.

How to do it:

1. 1

   Add the wildcard

   Click Add a domain and type *.example.com. The first time, the dialog shows the two records to create — including your own {id}, which only the panel knows. Copy it from the panel, never guess it.

2. 2

   Create the two records

   Create both records at your DNS provider, DNS only.

3. 3

   Try again

   Click Try again. The wildcard certificate takes about 15 seconds. After that, everything is automatic — just keep both records in place.

Limits of a wildcard:

• One level only: *.example.com covers play.example.com, not a.b.example.com, and not example.com itself.
• A domain you add exactly (for example play.example.com) keeps its own certificate, which takes priority over the wildcard.

Using a domain on several networks

The same Bedrock domain can be added to several networks of your account — for example one network in NA and one in EU. Add it on each network, like any other domain.

A shared domain needs one more DNS record, the _acme-challenge CNAME, so that each network can get its own certificate:

; Lets Infinity-Filter validate and renew the certificate on every network.
_acme-challenge.bedrock.example.com.  300   IN   CNAME   {id}.acme.infinity-filter.com.

If it’s missing, the domain isn’t added and the panel shows the exact record to create — copy it from the panel, never guess the {id}. Create it (DNS only), wait a minute, then click Try again. Once the certificate is active, the record stays shown under the domain as a record to keep: don’t remove it, the renewals need it.

Players join the network the domain points to. A domain used by a network of another account is still refused.

Rules and limits

Deleting a domain

Click the delete button next to the domain and confirm.

Mobile players can no longer join with that domain. If you add it back within 30 days, its certificate is reused instantly. You can then remove the CNAME at your DNS provider if you don’t use it anymore.

API

Bedrock domains can also be managed with the Infinity-Filter API (token with the Domains permissions). The endpoints are documented in our Postman workspace.

FAQ

What’s next