Customer and portal custom domains (DNS proof)

A customer organization can have its sign-in page on the customer's domain, and the distributor can have its portal on its own domain. The domain owner proves control with a DNS TXT record; the service then obtains the certificate.

How do I add a domain to a customer?

1. Under «Distributor» › «Domains», pick the organization («Choose an organization»).
2. Choose «Add domain» and type the «Domain», for example signin.customer.com (no https:// or path).
3. The console shows the TXT record to create («Name» and «Value»): name _authguard.signin.customer.com, value authguard-domain-verification=agdv_…. Use «Copy name» and «Copy value».
4. The customer creates the TXT and points the name at the service: CNAME <slug>.authguard.pt. (for an apex domain, A records to the platform's address).
5. Choose «Verify». The service checks the TXT and issues the certificate (TLS-ALPN-01 on port 443). States: «Waiting for the DNS record», «Issuing the certificate», «Active».

If «The TXT record was not found yet. DNS changes can take a while; verify again later.» appears, wait and try again.

Primary domain

«Make primary» makes emails and activation links use that address. Passkeys are bound to the address where they were created: people create new passkeys at the new address. Phone approval does not work on custom domains. Announce the change and keep the old address during a transition.

Removing

«Remove» asks you to type the domain. It becomes «Being removed» and is released after 24 hours; a domain never verified is freed at once.

The portal domain

Under «Distributor» › «Domains», the «Portal domain» works the same way for the distributor's portal.

Limits

5 domains per organization by default; only the platform changes the limit. The TXT must stay: it is checked at every renewal, and three failures in a row retire the domain.