Set up two `A` DNS records: `tele.example.com` for all traffic and
`*.tele.example.com` for web apps using Application Access. We are assuming
that your domain name is `example.com`. Use your own subdomain instead of
`tele`.

<Details opened={false} title="Why are we using wildcard subdomains for Application Access?">
(!docs/pages/includes/dns-app-access.mdx!)
</Details>

<Details title="DNS instructions for cloud providers" opened={false}>

Execute the following commands on the host where you are running the Teleport Proxy
Service:

<Tabs>
    <TabItem label="AWS Route 53">
    ```code
    # Tip for finding AWS zone id by the domain name.
    $ MYIP="$(curl https://ipv4.icanhazip.com/)"
    $ MYZONE_DNS="example.com"
    $ MYZONE=$(aws route53 list-hosted-zones-by-name --dns-name=${MYZONE_DNS?} | jq -r '.HostedZones[0].Id' | sed s_/hostedzone/__)

    # The fully qualified domain name for your Teleport Proxy Service.
    # These commands will also create an A record for a wildcard subdomain.
    $ MYDNS="tele.example.com"

    # Create a JSON file changeset for AWS.
    $ jq -n --arg ip ${MYIP?} --arg dns ${MYDNS?} '{"Comment": "Create records", "Changes": [{"Action": "CREATE","ResourceRecordSet": {"Name": $dns, "Type": "A", "TTL": 300, "ResourceRecords": [{ "Value": $ip}]}},{"Action": "CREATE", "ResourceRecordSet": {"Name": ("*." + $dns), "Type": "A", "TTL": 300, "ResourceRecords": [{ "Value": $ip}]}}]}' > myrecords.json

    # Review records before applying.
    $ cat myrecords.json | jq
    # Apply the records and capture change id
    $ CHANGEID=$(aws route53 change-resource-record-sets --hosted-zone-id ${MYZONE?} --change-batch file://myrecords.json | jq -r '.ChangeInfo.Id')

    # Verify that change has been applied
    $ aws route53 get-change --id ${CHANGEID?} | jq '.ChangeInfo.Status'
    # "INSYNC"
    ```
  </TabItem>
  <TabItem label="GCP Cloud DNS">
    ```code
    $ MYZONE="myzone"
    # The fully qualified domain name for your Teleport Proxy Service.
    # These commands will also create an A record for a wildcard subdomain.
    $ MYDNS="tele.example.com"
    $ MYIP="$(curl https://ipv4.icanhazip.com/)"

    $ gcloud dns record-sets transaction start --zone="${MYZONE?}"
    $ gcloud dns record-sets transaction add ${MYIP?} --name="${MYDNS?}" --ttl="30" --type="A" --zone="${MYZONE?}"
    $ gcloud dns record-sets transaction add ${MYIP?} --name="*.${MYDNS?}" --ttl="30" --type="A" --zone="${MYZONE?}"
    $ gcloud dns record-sets transaction describe --zone="${MYZONE?}"
    $ gcloud dns record-sets transaction execute --zone="${MYZONE?}"
    ```
  </TabItem>


</Tabs>

</Details>

<Admonition
  type="tip"
  title="Tip"
>
  You can use `dig` to make sure that DNS records are propagated:

  ```code
  $ dig tele.example.com
  ```
</Admonition>