---
schema_version: "1"
id: 75a8207f228c8476f60043dd2721fb19cce171b75307bd391613139c5f0df8b3
title: Prerequisites for a Custom Domain That Uses a Third-Party Service or CDN
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/domain_mgmt_enable_https.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_enable_https.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: b80e5f791b556fa203bee39fe0593ed7e4df55b602b8328818ca8bf452f411c2
description: If a non-Salesforce service or content delivery network (CDN) serves your domain, complete these steps before you add your domain in Salesforce. To confirm your domain ownership, update your domain’s Domain Name Service (DNS) configuration. Then work with the third-party provider to ensure access to the required HTTP protocols, configure caching and request handling, and review reverse proxy restrictions. If you’re using a third-party CDN, update the header in your CDN to track IP addresses.
products:
  - Salesforce Platform
  - Security
release: "264"
---
# Prerequisites for a Custom Domain That Uses a Third-Party Service or CDN

If a non-Salesforce service or content delivery network (CDN) serves your domain, complete these steps before you add your domain in Salesforce. To confirm your domain ownership, update your domain’s Domain Name Service (DNS) configuration. Then work with the third-party provider to ensure access to the required HTTP protocols, configure caching and request handling, and review reverse proxy restrictions. If you’re using a third-party CDN, update the header in your CDN to track IP addresses.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Performance</strong>, and <strong>Unlimited</strong> Editions.</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Applies to: Salesforce Sites and <a href="https://help.salesforce.com/s/articleView?id=experience.exp_cloud_basics_glossary.htm&amp;language=en_US" target="_blank">LWR, Aura, and Visualforce sites</a></td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
      <colgroup>
        <col style="width:50%">
        <col style="width:50%">
      </colgroup>
      <thead class="slds-text-title_caps ">
        <tr class="">
          <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d25894e76">User Permissions
            Needed</th>
        </tr>
      </thead>
      <tbody>
        <tr class="">
          <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d25894e76 ">To view a domain:</td>

          <td class="slds-cell-wrap" style="vertical-align:top;" headers="d25894e76 ">
            <p>Manage Custom Domains</p>
            <p>OR</p>
            <p style="margin-bottom:0;">View Setup and Configuration</p>
          </td>

        </tr>
      </tbody>
    </table>

![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/images/icon_tip.png)

Tip Unfamiliar with terms like DNS, CNAME, and proxy server? See [Custom Domain Terminology](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_terms.htm&release=264.0.0&type=5 "Review the terms related to setting up a custom domain in Salesforce.").

## Update Your Domain’s DNS Configuration

When you add a custom domain, Salesforce checks DNS to verify that you own the domain. Before you set up your custom domain that uses a third-party service or CDN, update DNS to include the required canonical name (CNAME) or text (TXT) record for your domain.

- If your domain has an existing A, AAAA, or CNAME record, you can’t add a CNAME record. Instead, use a TXT record in DNS to set up a temporary non-HTTPS domain. See [Use a Temporary Non-HTTPS Domain to Serve Your Custom Domain](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_temp_domain.htm&release=264.0.0&type=5 "Salesforce requires that you serve your custom domain via HTTPS. However, some configuration steps can require a temporary non-HTTPS configuration. If your HTTPS certificate isn’t ready to be uploaded to Salesforce, you can use a temporary domain to start configuring your custom URLs. Also, when your domain serves other content, or when you want to move a custom domain to a new production org, you can use a temporary domain to minimize disruption to your domain.").
- Otherwise, add a CNAME record in DNS that points to your org’s \*.live.siteforce.com CNAME. See [Point Your Custom Domain to Your Org](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_update_dns.htm&release=264.0.0&type=5 "Before you add a domain in Salesforce, point your domain to your Salesforce org in Domain Name Service (DNS). If your custom domain uses your HTTPS Certificate or the Salesforce content delivery network (CDN) partner, add a canonical domain name (CNAME) record for your fully qualified domain (FQDN) to DNS. The CNAME record references your Salesforce org ID and your FQDN. Then, if you plan to use the Salesforce CDN to serve your Experience Cloud site on your custom domain, add a second CNAME record that our CDN partner requires.").

After you configure your domain that uses a third-party service or CDN, you can delete the TXT or CNAME record. Deleting unnecessary DNS records can improve performance. Optionally, to make it easier to switch to another domain configuration option in the future, you can keep the CNAME record in DNS. If you choose to keep the record, check with your third-party provider to ensure that their services are supported with that configuration.

## Verify That Required HTTP Protocols Are Allowed

Some third-party hosts, CDNs, and web application firewalls (WAFs) restrict HTTP protocols. When the third-party provider that serves your custom domain doesn’t allow the DELETE and PATCH HTTP protocols, users can’t perform actions in Salesforce that rely on those protocols.

For example, assume that a third-party CDN serves a custom domain and that custom domain serves an Experience Cloud site page with an embedded a CRM analytics dashboard. If that third-party CDN doesn’t allow the HTTP PATCH and DELETE protocols, users can create a view within that dashboard, but they can’t edit or delete that view.

To prevent these issues, verify that your third-party service or CDN allows the POST, PUT, PATCH, and DELETE HTTP protocols. If the provider restricts these protocols by default, work with the provider to allow them for your domain before you activate your custom domain.

## Caching

Make sure that when your proxy or CDN service processes an incoming request without a cached response, the service forwards the request to your custom domain’s target host name using HTTPS.

Also, when caching responses, your CDN must honor the Salesforce `Cache-Control` response header. Specifically, ensure that your CDN follows these rules when it operates as a reverse-proxy server.

- Your CDN caches responses only when `public` exists in the Salesforce `Cache-Control` response header.
- If `private`, `no-store`, or `no-cache` exists in the Salesforce `Cache-Control` response header, the CDN doesn’t cache that response.
- To determine the cache duration, the CDN uses `s-maxage`, if present in the Salesforce Cache-Control response header. If `s-maxage` isn’t present, then the CDN uses `max-age`. The CDN never increases the cache duration, regardless of whether it’s derived from `s-maxage` or `max-age`.

## Request Configuration: Host HTTP Header

To serve your custom domain with a third-party service or CDN, configure your proxy or CDN service so that the requests sent to Salesforce contain the originally requested `Host` HTTP header. In other words, ensure that your custom domain name—the domain that users see in their original web browser request—is the `Host` HTTP header value in requests sent to Salesforce.

As an example, let’s say that a non-Salesforce CDN serves your custom domain, www.example.com. When a web browser requests https://www.example.com/hello/world, your CDN sends the request to Salesforce at https://MyDomainName.my.salesforce.com/hello/world while setting the `Host` header to www.example.com. Salesforce then processes the request at MyDomainName.my.salesforce.com as a request for www.example.com with a path of /hello/world. If the `Host` header isn’t set to your custom domain, `www.example.com`, then Salesforce can’t process the request properly.

## URL Paths in Requests

Ensure that your third-party service or CDN processes requests without decoding the path of the requested URLs. For example, if the path includes `%2F`, Salesforce requires that the URL includes `%2F`, not the decoded ASCII value, `/`.

## Point Your Custom Domain to Your Org with Your Target Host Name

To point your custom domain that uses a third-party service or CDN to your org, the third-party uses a target host name. A target host name is the host name to which your proxy or CDN forwards requests to your custom domain. In other words, the target host name is how your third-party service or CDN delivers content from your sites in Salesforce.

For custom domains that use a third-party service or CDN, your org’s My Domain login URL is the target host name for the domain. Work with your third-party provider to forward your proxy or CDN requests to that host name.

To get the target host name to provide to your third-party service or CDN, in Setup, find and select **Domains**, and then click **Add Domain**.

When you select **Use a third-party service or CDN to serve the domain**, your target host name is included in the guidance for that domain configuration option.

![The Domain setup page with a circle around the text under the selected HTTPS option that calls out the target host name.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/extend_click/images/domain_add_target_hostname.png)

## Reverse Proxy Restrictions

A reverse proxy is a type of proxy server used to direct client requests to the server that provides the requested resource. Because reverse proxies can increase scalability, performance, resilience, and security, large websites and CDNs often use reverse proxies as part of their load-balancing techniques.

To ensure that traffic is routed to the correct site URL, we recommend that your third-party service or CDN’s reverse proxy server forward the full root-relative path of your site. For example, when delivering resources from `https://MyDomainName.my.site.com/store/sales`, the service or CDN’s reverse proxy server passes /store/sales, not the relative path /sales. Otherwise, some pages and features can load resources from paths outside of a site’s prefix.

If your third-party service or CDN declines to forward the full root-relative path for all requests, we strongly recommend that you test your custom domain for any resulting issues. During testing, identify the places where resources are incorrectly loaded. Then work with your third-party service or CDN to update their reverse proxy server to correctly handle those requests.

## Configure Your CDN to Pass the Origin IP Address

If you use an external CDN and location-based audience targeting in Experience Cloud, set the `True-Client-IP` HTTP header in your external CDN. Without this header, audience targeting can return unexpected results.

If you use an external CDN and you use IP restrictions for location-based audience targeting in Experience Cloud, set the `True-Client-IP` header in your external CDN. This setting helps to pass the IP address of the original client back to Salesforce. Without this header, calls to your site and audience targeting can return unexpected results. For more information about IP address tracking and restrictions with a custom domain, see [Considerations for Custom Domains That Use a Third-Party Service or CDN](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_external_host_considerations.htm&release=264.0.0&type=5 "Review how IP address tracking works when a third party serves your custom domain. Understand what happens if you update your domain’s external configuration after you activate the domain in Salesforce, and clean up unnecessary Domain Name Service (DNS) records.").

For help with setting the `True-Client-IP` header, including any additional recommended settings to protect you against address spoofing, refer to your CDN provider documentation.

#### See Also

- [Salesforce Edge Network](https://help.salesforce.com/s/articleView?id=xcloud.domain_name_edge_network.htm&type=5&language=en_US)
- [Custom Domains](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt.htm&release=264.0.0&type=5 "Provide a branded experience for users who access your external-facing Salesforce content by serving your Digital Experiences or Salesforce Sites on a domain that you own, such as https://www.example.com.")
- [Considerations for Custom Domains That Use a Third-Party Service or CDN](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_external_host_considerations.htm&release=264.0.0&type=5 "Review how IP address tracking works when a third party serves your custom domain. Understand what happens if you update your domain’s external configuration after you activate the domain in Salesforce, and clean up unnecessary Domain Name Service (DNS) records.")
- [Set Up a Custom Domain That Uses a Third-Party Service or CDN](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_external_host_setup.htm&release=264.0.0&type=5 "Add a domain in Salesforce that’s hosted by a non-Salesforce service or content delivery network (CDN). After you set up your domain in Salesforce, that domain can serve your Experience Cloud sites or Salesforce Sites.")