Clearer custom domain status and sync

Custom identity hostnames failed in ways that were hard to see: a saved URI that was not synced, a nested hostname the tenant had not verified, or a status that did not match DNS. Tenant and environment domain settings now make identity-flow URI, DNS sync, and status explicit.

This is the longer note behind the December 28 changelog entry.

How it works

Each environment stores an Identity Flows URI (identityFlowUri) as a hostname only — no scheme, path, port, or localhost. That host is what hosted sign-in and OIDC discovery should use after sync.

Tenant Settings > Domains still owns parent-domain verification (TXT). A verified apex can back the apex or one subdomain level (example.com or auth.example.com). Nested-domain handling follows that verified parent; a hostname the tenant has not verified will not sync.

Sync Domain checks DNS against the vanity edge, binds the hostname for routing, and probes HTTPS so the edge can issue a certificate. Status in tenant and environment domain views should move to Synchronized (ready or active) when that succeeds.

The branding designer only switches the preview iframe to the custom host after the domain is actually synchronized.

Set it up

1. Verify the parent domain under tenant Settings > Domains.
2. Open the environment Domains module and enter the hostname in Identity Flows URI.
3. Create the CNAME to the regional edge target the console shows (DNS-only, not proxied).
4. Run Sync Domain and wait for Synchronized.
5. Complete hosted sign-in on that host before production traffic.

Full DNS rules are in Custom domains.

Trust boundaries

A saved URI is not a live custom domain until sync succeeds. Do not treat a green form field as TLS or routing.

Changing the hostname can change OIDC callback URLs. Update every IdP allowlist after the new host is synchronized.

Try it

Register a non-production hostname, sync it, and sign in on that host. Console notes are in Domains. The original release note is in the changelog.