Your organization's custom domains (administrator view)

An organization can have its sign-in page on its own domain, for example signin.example.com. Your provider registers and verifies domains; the organization's administrator sees them read-only.

Where do I see the domains?

«Manage» › «Domains» («Custom domains»): «The addresses of this organization's sign-in page. Your provider registers and verifies them; ask them for any change.»

Each domain shows its state: «Waiting for the DNS record», «Issuing the certificate», «Active», «Failed — verify again» or «Being removed», and whether it is the «Primary».

What do I need to do in DNS?

When your provider adds the domain, the console shows the TXT record that must exist: «This TXT record must exist at the domain's DNS provider before your provider can verify the domain». Also create the record that points the name at the service (usually a CNAME), as your provider says. Keep the TXT record: it is checked at every certificate renewal.

What changes when a domain becomes primary?

• Emails and activation links use that address.
• Passkeys are bound to the address where they were created: people must create a passkey at the new address to use it. The old address keeps working while its domain stays active.
• OIDC services, SAML applications and Microsoft 365 keep the address they were configured with.
• Phone approval does not work on custom domains: people link their phone at the default address.

How many domains can I have?

Five by default. Your provider can raise the limit.