Custom Domains
Configure tenant-branded Shared Record hosts with PacSpace-managed TLS.
Custom domains let a tenant serve Shared Record links from a branded hostname while keeping the record on PacSpace's neutral infrastructure.
Example:
https://verify.example.com/c/{customerHandle}
GET https://app.pacspace.io/dashboard/tenant-domains
DNS
Tenant subdomains should point to the PacSpace target shown in the Settings page. In the common setup, the tenant adds a CNAME from their branded hostname to customer-links.pacspace.io.
PacSpace does not require tenants to publish a fixed IP address in this launch. If an A-record setup is needed, contact support for the current target and rotation guidance.
Ownership Verification
Before activation, the tenant must prove control of the hostname with the TXT challenge shown in Settings. PacSpace checks ownership before requesting TLS or binding the route.
Provisioning Stages
| Stage | Meaning |
|---|---|
PENDING_OWNERSHIP | Waiting for TXT ownership challenge |
CNAME_PENDING | Waiting for DNS route target |
CERT_REQUESTED | Managed certificate requested |
CERT_ISSUED | Certificate is active |
ROUTE_BOUND | Host is bound to the Shared Record edge |
Provisioning is retried by a reconciler with bounded waits. The tenant does not upload private keys or certificates.
Brand Attribution
The doctrine footer is always shown:
Written by {Vendor}. Visible to both. Owned by neither.
On a verified custom domain, tenants can suppress the additional "Powered by PacSpace" attribution. Suppressing the brand line does not change the record, proof, audit, or security model.
Renewal Alerts
PacSpace monitors certificate renewal windows. If an active custom domain is close to expiry or renewal fails, admins and managers see a dashboard banner and tenants may receive the tenant_domain.cert_renewal_failed webhook.