Skip to main content
SourceTrustSign in

Help center

Guides for SourceTrust: Importing dependencies, reviewing licenses, external obligations, publishing attestation pages, billing, plain-language license explainers, and procurement-oriented explainers for common open-source licenses.

Custom domain setup

← All articles

Serve public attestation pages on a hostname you control, such as licenses.yourcompany.com. Billing counts every hostname, up to ten per organization.

Removing a hostname stops it immediately. On an active subscription, a confirmed billing update credits the unused part of the period on the next invoice. If billing is unresolved, the removal confirmation says so and makes no credit promise. Cleanup after a subscription ends creates no credit. Removal is blocked while a payment is overdue or the subscription is paused; resolve that state first.

The custom domain add-on lets buyers open your attestation pages on a hostname you control instead of sourcetrust.app/your-org/your-project. Billing counts each hostname, up to 10 per organization.

Before you start

  • You need owner or finance access to enable billing and manage DNS setup.
  • Use a subdomain such as licenses.example.com with a publicly visible, DNS-only CNAME and flattening disabled. Domain roots (including example.co.uk), delegated DNS zone roots, proxies, ALIAS and ANAME are not supported.
  • You must be able to add DNS records at your domain provider (CNAME and sometimes TXT).

Step 1: Enable the add-on

Open Billing and choose Add custom domain. Adding a hostname adds one billed custom-domain unit to your subscription. You can also open Organization settings → Custom domain once billing is enabled.

Step 2: Register your hostname

Enter your subdomain during checkout. Before registration, SourceTrust checks whether it is currently a DNS zone root. If that check is unavailable, try again later. After purchase, open Organization settings → Custom domain to see every available DNS instruction immediately.

Step 3: Add DNS records

Copy all records from the table in the app and add them at your DNS host. Ownership and certificate records are shown before routing is confirmed. When a certificate delegation CNAME is available, the alternative certificate TXT is hidden. The Purpose column explains each record:

  • Route traffic. A DNS-only CNAME pointing your subdomain at the displayed SourceTrust target. Disable CNAME flattening and keep this record in place.
  • SSL certificate. A one-time _acme-challenge CNAME (preferred) or TXT records for HTTPS. Keep the CNAME in place for automatic renewals.
  • Domain ownership. Proves you control the domain before we serve content on it.
Use Copy record on each row to paste all three fields (type, name, value) into a ticket or your DNS provider's notes. DNS can take a few minutes to several hours to propagate.

Step 4: Verify DNS

After adding the records, click Check DNS. Live requires confirmed routing plus completed hostname and certificate verification. Initial setup is checked about hourly; Live and Failed domains are checked no more than daily. A temporary DNS-check failure preserves an existing routing confirmation. You can leave the page and come back later.

If verification fails

A confirmed routing loss or stopped verification marks the domain Failed and appears in Needs your attention. An email is scheduled for your organization's notification recipients on the transition to Failed. Initial setup also becomes Failed if it cannot be confirmed within 14 days. Check every DNS record and use Retry verification to restart stopped validation. The domain stays Failed while recovery is pending and returns to Live only when routing, hostname and certificate are confirmed together. If the registration is unavailable, contact support to restore it; another purchase is not the recovery step.

When it is live

  • Org index: When the organization landing page is enabled in Organization settings → Publishing, https://your-hostname/ opens the public directory without signing in. Disabling it makes the root unavailable; individual project pages remain available.
  • Assigned eligible projects: https://your-hostname/project-slug (use the slug from project settings).
  • Once Live, choose the hostname per eligible project in Public URL host. In-app links and old sourcetrust.app project links then use that hostname. Paths that conflict with an application page, such as billing or analytics, automatically keep their working Platform URL, even if a custom hostname was previously selected. Settings explains this and disables custom choices for that project.
  • Click Open your site in the app to confirm the page loads in a browser.
Disabling the custom domain add-on removes the hostname and clears setup. Public pages fall back to sourcetrust.app/your-org/your-project until you set up a custom domain again.