When you point a custom domain at Substack, the platform tells you it can take “up to 24 hours” for everything to work. That’s technically true, but misleading—because your domain will resolve to Substack’s servers long before the SSL certificate provision finishes.
This creates a specific problem: readers who visit your new domain during the gap see either a certificate warning or a “not secure” flag in their browser. If you’re migrating from a self-hosted archive or another platform, that window matters more than Substack’s docs suggest.
What actually happens during the setup window
Substack’s custom domain process has two distinct phases that don’t finish at the same time.
First, DNS propagation. You add a CNAME record pointing your subdomain (usually newsletter.yourdomain.com) to subdomain.substack.com. Most DNS providers push that change globally within 5–15 minutes. Once it propagates, requests to your domain resolve to Substack’s infrastructure.
Second, SSL certificate provisioning. After Substack detects the CNAME, it requests a Let’s Encrypt certificate for your domain. This involves a challenge-response validation that can take anywhere from 10 minutes to several hours, depending on Let’s Encrypt’s queue and how aggressively Substack’s automation retries.
The gap between the two creates the problem. Your domain is live and serving pages—but without a valid HTTPS certificate. Browsers warn users. Email clients flag links. If you announce the migration before SSL finishes, a portion of your audience sees errors.
How long the SSL delay actually lasts
In practice, most Substack custom domains finish SSL provisioning within 90 minutes of DNS propagation completing. I’ve migrated eight newsletters to custom domains on Substack since early 2025; six took under an hour, one took three hours, and one required a support ticket after stalling for 12 hours.
The stall case was a domain that had previously pointed to another newsletter platform. Substack’s system appeared to cache an older validation attempt and didn’t retry automatically. Support cleared it manually within 20 minutes of the ticket.
Substack doesn’t expose provisioning status in the dashboard. The settings page shows “DNS configured” as soon as the CNAME resolves, but there’s no separate indicator for “SSL active.” You have to test the domain in a browser and check for the padlock.
The non-obvious timing trick
Set up your custom domain at least 48 hours before you announce the migration.
Substack allows you to configure a custom domain without switching your publication’s primary URL immediately. Once the CNAME is added and SSL finishes provisioning, the custom domain works as an alias—readers can visit it, links resolve correctly, but your posts and emails still use the yourname.substack.com address.
This gives you a clean testing window. Verify SSL, check that archive links work, confirm that your website’s nav links resolve correctly. Then switch the primary domain in Substack’s settings when you’re ready to announce.
The switch itself is instant. Substack updates all post URLs and sets up 301 redirects from the old subdomain to the new domain. Emails sent after the switch use the custom domain in from-addresses and link URLs.
One edge case: if you’re moving from another platform entirely (say, WordPress or Ghost) and pointing an existing domain at Substack, you lose the testing window. The CNAME change is live immediately, so there’s no way to preview without breaking the old site. In that case, either accept the SSL gap or set up the Substack publication on a temporary subdomain first, migrate content, then switch the CNAME during a low-traffic window.
What to tell readers during the gap
If you’re migrating during business hours and can’t wait out the SSL delay, send a heads-up email before you flip the CNAME. Something like: “We’re moving to [new domain] today. If you see a security warning in the next hour, that’s expected—refresh in 15 minutes and it’ll clear.”
Most readers won’t visit during the gap, but the ones who do will appreciate knowing it’s temporary. Browser warnings make people assume they’ve been phished; a short explanation prevents that panic.
For newsletters with large back catalogs, check your most-linked posts after SSL provisions. Substack’s redirects handle yourname.substack.com/p/post-slug to newsletter.yourdomain.com/p/post-slug correctly, but if you’ve previously shared links with UTM parameters or other query strings, test a few samples to confirm they resolve.
One Two Three Send publishes operator-focused breakdowns like this one every day. Subscribe to get them in your inbox, or reply with questions about your own custom domain setup—we’ll cover edge cases in a future Q&A piece.