Tunnels

ngrok and Cloudflare Tunnel make a machine reachable that the internet cannot reach, by carrying every request through their own network. If something outside has to connect to a machine that has no way of accepting connections, that is the answer and this page is not going to talk you out of it.

What we do instead

We give a name to something you already have: an address, public or private, or a platform endpoint the hostname follows. We answer DNS for it and nothing else. No traffic is proxied, terminated or inspected, and there is no path through us for it to take.

A name without reachability is still worth having

A machine behind NAT can hold a DNSMint hostname and a publicly trusted certificate over DNS-01 and still be reachable only from inside its own network. That is the ordinary case for anything serving a private network: the browser on the LAN gets a real certificate and no warning, and nothing outside can connect to it.

Using both

Some tunnels hand you a URL rather than an address. POST it as target instead of ip and the hostname follows it, so the name people hold is yours while the reachability is theirs. Moving off that tunnel later is a PUT rather than a new URL to hand out.

The quickstart goes from an address to HTTPS, and the other comparisons cover the rest of what people use instead.