Municipal QR codes on your own subdomain: building trust with residents

QR codes now sit on bins, roadworks signs and notice boards. Before scanning, people see only an address, and with many services it is an abbreviation that has nothing to do with the town. Scammers exploit exactly that in quishing: they stick their own code over the real one and send residents to a fake page.

What your own subdomain changes

With a subdomain like qr.yourtown.org, the phone’s preview shows a name everyone knows. You can give residents a simple rule: only addresses ending in yourtown.org are official. That is easier to remember than a list of short-link services.

What it cannot do

An address of your own does not stop someone from sticking a foreign label over yours. It does make the fake recognisable when people look at the address before opening it. So keep checking notices and signs regularly, and say so in the town newsletter.

Three everyday examples

• Waste calendar: qr.yourtown.org/waste-dates on a sticker on the bin. Each year only the destination changes, the printed sticker stays.
• Roadworks: qr.yourtown.org/roadworks-main-street on the sign. Current closures and diversions live on the destination page and can change without replacing the sign.
• Town newsletter: qr.yourtown.org/newsletter in the print edition and on the notice board. A new issue is just a new destination.

In all three cases the code is dynamic. The path is printed once, the destination behind it stays editable.

Who does what

The setup is split. The council’s IT team or the provider that manages the domain sets two DNS records. Everything after that is done by the administration itself: creating codes, changing destinations, viewing scans. To save the IT team follow-up questions, send them these points:

• Subdomain: qr.yourtown.org (the subdomain only, the main domain stays untouched).
• A TXT record _sameqr.qr.yourtown.org with the value shown in the dashboard, as proof of ownership.
• A CNAME record from the subdomain to kunden.sameqr.com.
• If DNS is hosted at Cloudflare, set the CNAME to “DNS only” (grey cloud).

How the setup goes

In the dashboard you open the “Own domain” window and enter the subdomain. Same-QR then shows you both records. Once they are set, the service issues an HTTPS certificate automatically and the status changes to “Active”. When creating a new code you pick the address, either sameqr.com/r/… or your domain. You write the path yourself, such as /waste-dates, or let it be generated at random (10 characters). Each path exists only once per domain and stays taken even after the code is deleted.

The domain belongs to the town

The domain always stays yours. If the town changes provider later, IT switches the CNAME. Codes that are already printed keep working as long as the new provider can serve the same paths on your domain. With Same-QR, an own domain starts at the Gastro Pro or Marketing Starter plan, while the Free plan (20 dynamic codes, 1,000 scans a month) includes none. Check the number per plan on the pricing page before you plan.

Frequently asked questions