SSO domain verification without an IT ticket
Your customer's admin starts it in your settings. We write or show the TXT record, or email it to IT.
For platform engineers and onboarding product managers at apps whose customers turn on SSO.
Verify acme.com
Single sign-on turns on once this record is in the DNS of acme.com.
DNS at Cloudflaresign in
pending propagating live
connection.live reached your server, so your app runs its own check.
What stalls SSO today
| What stalls | Who says so |
|---|---|
| The admin setting up SSO often cannot edit DNS. | Claude, Apple Business, Microsoft Entra ID |
| The value must be exact, and some consoles show it only once. | Claude |
| Deadlines run while the ticket waits: 14 days at Apple, thirty at WorkOS. | Apple Business and WorkOS |
| The record has to stay. Without it, SAML sign-on stops working. | Atlassian |
From each service's own help pages, read October 31, 2026.
How it works
| Step | What happens |
|---|---|
| Supply | Your server supplies the TXT record with an API key. |
| Write or show | Your customer signs in at their provider, pastes a key they create, or gets the exact row. |
| Or email IT | IT gets the record, your note and a link that works for 30 days. |
| Live | connection.live tells your server. Your app runs its own check. |
One-click setup and the secure sign-in do not carry your record, so there the row is added by hand. Supplied records are refused in test mode. If another CustomDomain™ account already serves acme.com, a new connection to it is refused.
Where the record can be written
- sign in
Written with their sign-in
- Cloudflare
- DigitalOcean
- Vercel
- Netlify
- DNSimple
- api key
Written with their key
- GoDaddy
- IONOS
- Porkbun
- Amazon Route 53
- by hand
Shown, then checked
- Namecheap
- Squarespace
- NameSilo
Names and logos belong to their owners. We write the records where the provider allows it and show the exact ones where it does not. A name here does not mean the provider endorses us.
One-click setup and the secure sign-in do not carry your record. There, your customer adds the row. Ways in from the provider census, read October 31, 2026. DNS provider directory
Cloudflare and the Cloudflare logo are trademarks and/or registered trademarks of Cloudflare, Inc. in the United States and other jurisdictions. Vercel, the Vercel design, Next.js and related marks, designs and logos are trademarks or registered trademarks of Vercel, Inc. or its affiliates in the US and other countries. DigitalOcean and all related logos are trademarks of DigitalOcean, LLC or its affiliates. dnsimple is a registered trademark of DNSimple Corporation.
After it is live
Every live domain is checked once an hour, and the console shows drift.
From the API reference (MonitorView, read October 31, 2026), trimmed. Values are examples.
{
"domain": "acme.com",
"watched": true,
"every": "hour",
"result": "ok",
"checked": 1
}Drift alerts are not sent on the hosted service today.
Common questions
Do you set up SSO for us?
No. CustomDomain™ handles the DNS record. Your identity provider and your app handle sign-in.
Does it work with WorkOS?
WorkOS returns a verification_token and gives the record as Name acme.com, Value verification_token= plus the token. Your server supplies that record. When connection.live arrives, it reads the domain's state from WorkOS.
What if IT wants to do it themselves?
Email them the record and a setup link. The widget shows them the exact row with their provider's steps.
Can the token change later?
Not in place. Once your record is written, the set is fixed. To change it, disconnect the domain and connect it again with the new record.
What if acme.com is already connected for another account?
A new connection to it is refused until it is disconnected there.
Anthropic, Apple, Microsoft, WorkOS and Atlassian own their names, and none of them endorses CustomDomain™. Facts about their services were read on October 31, 2026.
Put your customers on their own domains.
Your first ten domains connect free. No card needed to sign up.