Set up a custom domain

A custom domain serves the applicant verification journey on a subdomain you own, for example verify.yourcompany.com, instead of the default platform domain. Applicants see your domain in the address bar for a seamless, branded experience.

Custom domains are available on the Max plan. On other plans the settings page shows an upgrade option instead of the editor.

Only organization Owners and Admins can add or change a custom domain. Other members see a notice and the editor is hidden.

Add a custom domain

1. Open Settings -> Custom domain.
2. Enter the subdomain you want to use (for example verify.yourcompany.com) and save.
3. The page shows two DNS records to add at your DNS provider. Copy each record’s value with the copy button next to it.
4. Add both records in your DNS provider, then wait for them to take effect. The page updates automatically as the records are detected and the certificate is issued.

The DNS records

You add two CNAME records. The console shows the exact name and target for each one, so copy the values from there rather than typing them by hand.

Record	Type	Purpose
Routing record	CNAME	Points your subdomain to the platform so applicant traffic reaches the verification journey.
Certificate-validation record	CNAME	Points _acme-challenge.<your-subdomain> to a validation target ending in .dcv.cloudflare.com. This completes certificate issuance automatically, so there is no code to copy back or extra record to add.

Both records must resolve before the domain can go active. The routing record makes the subdomain reachable, and the certificate-validation record lets the certificate be issued without any manual approval step.

Keep both records unproxied

This is the most common reason a domain never activates.

Some DNS providers offer a proxy or CDN toggle on individual records (sometimes shown as an orange cloud or a “proxied” switch). You must set both records to unproxied, which most providers label “DNS only”.

A proxied record hides its real target behind the provider, so certificate validation can never see the value it needs and the domain stays stuck in a pending state. If your domain is not activating, check this first: open each record at your DNS provider and confirm it is set to “DNS only”, not proxied.

Validation and status

After the records resolve, the certificate is issued automatically. This usually takes a few minutes. The settings page polls for updates, so you can leave it open and watch the status change without reloading.

The status moves through these states:

• Pending: the records have not been detected yet, or the certificate is still being issued. The DNS records stay visible so you can double-check them.
• Active: the domain is live. New verification links use your custom domain.
• Failed: validation could not complete. The page explains what to fix (most often a proxied record, per the section above) so you can correct the records and retry.

Troubleshooting

• The domain stays “pending” for a long time. Confirm both records exist at your DNS provider, that their values match what the console shows exactly, and that both are set to “DNS only” (unproxied). A proxied certificate-validation record is the usual cause.
• The status shows “failed”. Read the message on the page, correct the records it points to, and the page picks the change up automatically on the next check.
• Applicants still see the default domain. A domain only takes over new verification links once it is Active. Links created before activation keep the domain they were issued with.

Related

• Customize organization branding: colors applied across the applicant flow and emails
• Glossary