Vanity DNS and custom domain sync

Users notice the hostname on hosted sign-in. A default Authdog host works, but cookies, redirects, and issuer URLs then sit on that host instead of yours. Custom identity domains now verify against the regional vanity edge, the Domains page shows registration / DNS / Sync status clearly, and session cookies follow the active hostname.

This is the longer note behind the August 9 changelog entry.

How it works

Two levels still apply:

1. Tenant Settings > Domains — prove the apex (for example example.com) with a TXT record until the console marks it Verified.
2. Domains on the environment — bind a hostname such as auth.example.com, register it as a vanity name, point DNS at the regional edge, then Sync Domain.

Sync verifies DNS against the vanity edge, binds the hostname for routing, and probes HTTPS so the edge can issue a certificate. Status should reach Synchronized (ready or active) before you send production traffic.

Once the hostname is verified, environment routing resolves from that custom host and the regional edge host. Session cookies and post-sign-in redirects are scoped to the active custom domain, not the default Authdog host.

OIDC issuer and discovery follow the custom host. Provider callback URLs change with it.

Set it up

In the Authdog console:

1. Open tenant Settings > Domains, add the apex, create the displayed TXT record, and wait for Verified.
2. Select the project and environment. Open Domains.
3. Enter the identity hostname (hostname only, no scheme or path).
4. Under Vanity domains, add the same hostname if Sync has not registered it yet.
5. At your DNS provider, CNAME that hostname to the regional edge target the console shows (for example a *-dns.authdog.com name). Use DNS-only; do not orange-cloud proxy it.
6. In Verified Domains, choose Sync Domain. Wait for Synchronized.
7. Sign in on the custom hostname and confirm the callback and session cookie host.

Full DNS rules and failure notes are in Custom domains.

Trust boundaries

Verify ownership before binding an environment. Do not point an unverified customer-controlled hostname at production identity.

Session cookies on the custom domain do not automatically exist on the old Authdog host. After cutover, users sign in again on the new host.

Certificate or DNS failure is an authentication outage. Keep the vanity hostname in Authdog until you have moved DNS, not the other way around.

Update every upstream OAuth / SSO allowlist with the redirect URI currently shown on Authentication > Providers. A stale callback is a provider error, not a cookie bug.

Try it

Register a non-production hostname, sync it, and complete hosted sign-in on that host. Setup is in Custom domains and Domains in the console. The original release note is in the changelog.