A custom hostname (for example, passport.brand.com) progresses through a defined lifecycle inside tieback. This page documents the states and what they mean operationally.
Verified hostnames are periodically re-validated. If DNS or certificate health degrades, the hostname transitions to Failing and the workspace receives a notification. Resolver traffic continues to serve from the platform subdomain so passports remain reachable.
Removing a custom hostname is immediate. Subsequent traffic to the removed hostname stops resolving via tieback. Existing passport URLs minted under that hostname continue to function only if DNS is repointed back; otherwise consumers should be migrated to the platform subdomain URL.