Overview

By default a tenant is reached at https://<tenant>.rikaiso.example. You can serve it under your own domain, for example https://help.contoso.example. Certificates are issued and renewed automatically once verification succeeds.

Procedure

1. Open Administration → Tenant → Domains and select Add domain.
2. Enter the fully qualified domain name. A verification token is displayed.
3. Create the DNS records below with your registrar.
4. Return to the tenant and select Verify. Propagation usually completes within 15 minutes.
5. When the domain shows Active, set it as the primary domain to redirect the default host.

DNS records

help.contoso.example.        300  IN  CNAME  edge.rikaiso.example.
_rikaiso.help.contoso.example. 300 IN TXT   "rikaiso-verify=8f2c41d0a7b94e5c"
contoso.example.             300  IN  CAA   0 issue "pki.rikaiso.example"

Keep the TXT record in place. It is re-checked before every certificate renewal, and removing it eventually takes the domain offline.

Notes

• Apex domains require an ALIAS or ANAME record; a CNAME at the apex is invalid.
• Only one primary domain is allowed per tenant. Additional domains redirect to it with HTTP 308.
• Single sign-on reply URLs must be updated to the new domain before switching, or users are returned to an unregistered host.

If verification fails with token-mismatch, the registrar has appended the zone name twice. Enter the record name as _rikaiso.help rather than the fully qualified form.