---
title: "Custom Domain Configuration"
description: "Serving a RIKAISO tenant under your own domain, including the required DNS records."
source: "https://help.rikaiso.com/2026.1/custom-domains"
version: "2026.1"
latest: true
language: "en"
section: "Administration"
updated: "2026-09-01"
---

# Custom Domain Configuration

> Serving a RIKAISO tenant under your own domain, including the required DNS records.

## Overview

By default a tenant is reached at `https://<tenant>.rikaiso.example`. You can serve it under your own domain, for example `https://help.contoso.example`. Certificates are issued and renewed automatically once verification succeeds.

## Procedure

1. Open **Administration → Tenant → Domains** and select **Add domain**.
2. Enter the fully qualified domain name. A verification token is displayed.
3. Create the DNS records below with your registrar.
4. Return to the tenant and select **Verify**. Propagation usually completes within 15 minutes.
5. When the domain shows *Active*, set it as the primary domain to redirect the default host.

## DNS records

```dns
help.contoso.example.        300  IN  CNAME  edge.rikaiso.example.
_rikaiso.help.contoso.example. 300 IN TXT   "rikaiso-verify=8f2c41d0a7b94e5c"
contoso.example.             300  IN  CAA   0 issue "pki.rikaiso.example"
```

Keep the TXT record in place. It is re-checked before every certificate renewal, and removing it eventually takes the domain offline.

## Notes

- Apex domains require an ALIAS or ANAME record; a CNAME at the apex is invalid.
- Only one primary domain is allowed per tenant. Additional domains redirect to it with HTTP 308.
- Single sign-on reply URLs must be updated to the new domain before switching, or users are returned to an unregistered host.

> If verification fails with `token-mismatch`, the registrar has appended the zone name twice. Enter the record name as `_rikaiso.help` rather than the fully qualified form.