Domains & Custom Hostnames

Custom Hostname Lifecycle

A custom hostname (for example, passport.brand.com) progresses through a defined lifecycle inside tieback. This page documents the states and what they mean operationally.

Lifecycle States

StateMeaningNext action
RequestedThe brand has registered the hostname in the workspace; DNS records have been issuedAdd the displayed CNAME / TXT records to your DNS
Pending VerificationDNS records are being polledWait — typically minutes to hours
VerifiedHostname ownership is confirmedCertificate issuance begins automatically
Certificate IssuedTLS certificate is provisioned and activeHostname is live for resolver traffic
ActiveLive and serving passport trafficNone — operational
FailingPeriodic re-validation has failedRe-check DNS; the dashboard surfaces the failing check
RemovedThe brand has removed the hostnameCustom URLs revert to the default subdomain

What Resolves Where

  • The dashboard is always served from the platform subdomain — custom hostnames do not expose the dashboard
  • The resolver serves passport traffic at both the platform subdomain and any verified custom hostname
  • Non-resolver app paths on a custom hostname return 403 Forbidden by design — see the custom domain restrictions policy

Re-Validation

Verified hostnames are periodically re-validated. If DNS or certificate health degrades, the hostname transitions to Failing and the workspace receives a notification. Resolver traffic continues to serve from the platform subdomain so passports remain reachable.

Removal

Removing a custom hostname is immediate. Subsequent traffic to the removed hostname stops resolving via tieback. Existing passport URLs minted under that hostname continue to function only if DNS is repointed back; otherwise consumers should be migrated to the platform subdomain URL.