# Custom domain

> Serve your Trust Center on your own domain, such as trust.yourcompany.com. Adding the domain, the DNS and CAA records it needs, and ownership verification.

Source: https://tidalcontrol.com/docs/trust-center/custom-domain

This article walks through setting up a custom domain for your Trust Center: adding it, creating the required DNS records, and what to expect during ownership verification and HTTPS provisioning.

## Serving your Trust Center on your own domain

Every Trust Center comes with a public Tidal Control URL based on your organisation name. You can also serve it on a hostname you own, such as `trust.yourcompany.com`. Visitors stay on your domain when they follow links from your website or security questionnaires.

## Adding the domain

You must use a subdomain, such as `trust.yourcompany.com`. A root domain (`yourcompany.com`) cannot be used because the required record is a CNAME.

{/* TODO: recapture this screenshot. It still shows the old two-step "Set up custom domain" wizard; the current UI adds the domain in one step directly in the Custom domain panel. */}

![The Share menu with the Custom domain panel](/images/help/trust_center_share_menu.png)

- Go to **Trust Center** > **Editor** in the main menu.
- Click the **Share** button in the toolbar.
- Under **Custom domain**, type the hostname you want to use and click **Add domain**.

![The CNAME and TXT records to create](/images/help/trust_center_dns_records.png)

- Go to your DNS provider's settings and create the two records shown in the **Custom domain** panel.

In Azure DNS, use **Add record set** in your DNS zone. The CNAME target goes in the **Alias** field:

![Adding the CNAME record set in Azure DNS](/images/help/trust_center_azure_cname.png)

![Adding the TXT record set in Azure DNS](/images/help/trust_center_azure_txt.png)

In AWS Route 53, create both records with **Quick create record** in your hosted zone:

![Creating the CNAME record in AWS Route 53](/images/help/trust_center_route53_cname.png)

![Creating the TXT record in AWS Route 53](/images/help/trust_center_route53_txt.png)

Once you create both records, come back to Tidal and click **Verify ownership**.

DNS changes can take up to 30 minutes to propagate. Once verified, the status moves to **Provisioning**.

## CAA records

{/* TODO: confirm the certificate authority used in production before publishing this section. The issuer is environment-configured; Let's Encrypt is the only CA referenced in the platform code. */}

CAA records restrict which certificate authorities can issue certificates for your domain. If your root domain has no CAA records, skip this section.

If it has them, allow Let's Encrypt for your hostname. Otherwise, the certificate cannot be issued and the domain stays at **Provisioning**:

```text
0 issue "letsencrypt.org"
0 issuewild "letsencrypt.org"
```

## Removing a custom domain

An unactivated domain disappears immediately when removed. An active domain shows **Removing** while routing and HTTPS are cleaned up. Once it disappears from the panel, you can add a different domain. Remember to delete the CNAME and TXT records at your DNS provider.