--- schema_version: "1" id: 3d68bbcd93563811c90dd2ac6575e99b833195ca8497ab43c4a832ff6bd8de99 title: Considerations for Custom Domains That Use a Third-Party Service or CDN collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/domain_mgmt_external_host_considerations.md canonical_url: https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_external_host_considerations.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: a6e9daffa89558104065cc609f01d84d1cc4f4933e3b8a4a1f203eb684e62670 description: Review how IP address tracking works when a third party serves your custom domain. Understand what happens if you update your domain’s external configuration after you activate the domain in Salesforce, and clean up unnecessary Domain Name Service (DNS) records. products: - Salesforce Platform - Security release: "264" --- # Considerations for Custom Domains That Use a Third-Party Service or CDN Review how IP address tracking works when a third party serves your custom domain. Understand what happens if you update your domain’s external configuration after you activate the domain in Salesforce, and clean up unnecessary Domain Name Service (DNS) records. ### Required Editions
Available in: both Salesforce Classic and Lightning Experience
Available in: Enterprise, Performance, and Unlimited Editions.
Applies to: Salesforce Sites and LWR, Aura, and Visualforce sites
![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/images/icon_tip.png) Tip Unfamiliar with terms like DNS, WAF, and CNAME? Want to review the difference between a DNS resolver and a certificate? See [Custom Domain Terminology](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_terms.htm&release=264.0.0&type=5 "Review the terms related to setting up a custom domain in Salesforce."). ## IP Address Tracking and Restrictions When you use a third party to serve your domain, Salesforce uses and logs the source IP address from the TCP/IP connection to Salesforce. The `True-Client-IP` request header is used for location-targeting features within an Experience Cloud site. If you use an external content delivery network (CDN) and location-based audience targeting in Experience Cloud, set this header in your CDN. For more information, see [Prerequisites for a Custom Domain That Uses a Third-Party Service or CDN](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_enable_https.htm&release=264.0.0&type=5 "If a non-Salesforce service or content delivery network (CDN) serves your domain, complete these steps before you add your domain in Salesforce. To confirm your domain ownership, update your domain’s Domain Name Service (DNS) configuration. Then work with the third-party provider to ensure access to the required HTTP protocols, configure caching and request handling, and review reverse proxy restrictions. If you’re using a third-party CDN, update the header in your CDN to track IP addresses."). IP restrictions at the profile level ignore the `True-Client-IP` request header for custom domains served by an external service or CDN. To restrict your guest users’ access to valid IP addresses for your custom domain, set the profile-level IP restrictions to allow only the IP addresses for your CDN or reverse-proxy server. For example, allow the addresses that your CDN uses to connect to Salesforce. Other source IP address request headers, such as the X-Forwarded-For (XFF) request header, are ignored. As a result, you can't pass the original source IP address to Salesforce for use with profile IP range restrictions, login history source IP addresses, and event log lines. ## Third-Party Changes After Domain Activation Salesforce validates that your domain points to your org when you add or view your domain in Salesforce. If you update your proxy, web application firewall (WAF), CDN, or the third-party settings after you activate the domain, that change happens outside Salesforce. As a result, Salesforce continues to serve the domain as if it uses HTTPS, even if the third-party configuration doesn’t have a valid HTTPS certificate for your custom domain. In this situation, your custom domain can experience disruption. If you suspect this cause for a disruption, view your custom domain details to validate that your domain points to your org. ## DNS Records to Validate Domain Ownership When you add your domain, Salesforce checks DNS to validate that you own the domain. To pass this verification, you add a canonical name (CNAME) or text (TXT) record for your domain in DNS. After you configure your domain that uses a third-party service or CDN, you can delete the TXT or CNAME record. Deleting unnecessary DNS records can improve performance. Optionally, to make it easier to switch to another domain configuration option in the future, you can keep the CNAME record in DNS. If you choose to keep the record, check with your third-party provider to ensure that their services are supported with that configuration. ## Streaming API Features Send CometD HTTP Requests If your third-party Experience Cloud site includes features that call the Streaming API, the API sends HTTP POST requests to your third-party content delivery network (CDN), not to Salesforce. CDNs have request rate limits, which can be exceeded when your site has many active users at the same time. For more information, see [_Streaming API Developer Guide_: Using an Experience Cloud Site with Streaming API-Based Features](https://developer.salesforce.com/docs/atlas.en-us.api_streaming.meta/api_streaming/streaming_api_experience_cloud_site.htm). #### See Also - [Custom Domains](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt.htm&release=264.0.0&type=5 "Provide a branded experience for users who access your external-facing Salesforce content by serving your Digital Experiences or Salesforce Sites on a domain that you own, such as https://www.example.com.") - [Prerequisites for a Custom Domain That Uses a Third-Party Service or CDN](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_enable_https.htm&release=264.0.0&type=5 "If a non-Salesforce service or content delivery network (CDN) serves your domain, complete these steps before you add your domain in Salesforce. To confirm your domain ownership, update your domain’s Domain Name Service (DNS) configuration. Then work with the third-party provider to ensure access to the required HTTP protocols, configure caching and request handling, and review reverse proxy restrictions. If you’re using a third-party CDN, update the header in your CDN to track IP addresses.") - [Set Up a Custom Domain That Uses a Third-Party Service or CDN](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_external_host_setup.htm&release=264.0.0&type=5 "Add a domain in Salesforce that’s hosted by a non-Salesforce service or content delivery network (CDN). After you set up your domain in Salesforce, that domain can serve your Experience Cloud sites or Salesforce Sites.") - [View Your Custom Domain Details](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_view.htm&release=264.0.0&type=5 "Get information about your custom domain. For example, scan the expiration dates for your HTTPS certificates that serve your domains. Or get the target host name for your domain that’s served by a third-party service or content delivery network (CDN). Also, you can view and manage the custom URLs associated with the domain, and view alerts about the domain’s DNS configuration.")