---
schema_version: "1"
id: b993be1ab1f2fb44a5792a75fc26da15d2604a48a9491644d26ee2588a995f65
title: Set Up a Custom Domain That Uses a Third-Party Service or CDN
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/domain_mgmt_external_host_setup.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_external_host_setup.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 5d111bdeeea04355b85aa88a6d060c3804eae7287a82427cbcc5d1385503e992
description: Add a domain in Salesforce that’s hosted by a non-Salesforce service or content delivery network (CDN). After you set up your domain in Salesforce, that domain can serve your Experience Cloud sites or Salesforce Sites.
products:
  - Salesforce Platform
  - Security
release: "264"
---
# Set Up a Custom Domain That Uses a Third-Party Service or CDN

Add a domain in Salesforce that’s hosted by a non-Salesforce service or content delivery network (CDN). After you set up your domain in Salesforce, that domain can serve your Experience Cloud sites or Salesforce Sites.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Performance</strong>, and <strong>Unlimited</strong> Editions.</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Applies to: Salesforce Sites and <a href="https://help.salesforce.com/s/articleView?id=experience.exp_cloud_basics_glossary.htm&amp;language=en_US" target="_blank">LWR, Aura, and Visualforce sites</a></td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d217479e78">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d217479e78 ">To view a domain:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d217479e78 ">
              <p>Manage Custom Domains</p>
              <p>OR</p>
              <p style="margin-bottom:0;">View Setup and Configuration</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d217479e78 ">To add a domain:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d217479e78 ">
              <p>Manage Custom Domains</p>
              <p>OR</p>
              <p style="margin-bottom:0;">View Setup and Configuration plus either a Site.com Publisher license or Create and Set
                Up Experiences</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d217479e78 ">To edit or delete a domain:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d217479e78 ">Manage Custom Domains</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d217479e78 ">To add, edit, and delete custom URLs:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d217479e78 ">
              <p>Manage Custom Domains</p>
              <p>OR</p>
              <p style="margin-bottom:0;">View Setup and Configuration AND either Create
                and Set Up Experiences OR a Site.com Publisher license</p>
            </td>

          </tr>
        </tbody>
      </table>

![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/images/icon_tip.png)

Tip Unfamiliar with terms like DNS, CNAME, and proxy server? See [Custom Domain Terminology](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_terms.htm&release=264.0.0&type=5 "Review the terms related to setting up a custom domain in Salesforce.").

Before you add a custom domain that’s hosted by a third-party service or CDN, review these important considerations.

- With this option, a third-party service or CDN hosts your domain. To use the recommended CDN for Digital Experiences, see [Serve Your Experience Cloud Site with the Salesforce Content Delivery Network (CDN)](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_salesforce_cdn.htm&release=264.0.0&type=5 "Optimize page load times and site performance with our content delivery network. Salesforce partners with a content delivery network (CDN) provider to efficiently deliver publicly cacheable content to users on your Experience Cloud sites. We recommend the Salesforce CDN for custom domains that serve Digital Experiences, including Experiences built with Experience Cloud, Commerce, and Industries licenses."). To use an HTTPS certificate that you own to serve your custom domain on Salesforce servers, see [Serve a Custom Domain with Your HTTPS Certificate on Salesforce Servers](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_cert.htm&release=264.0.0&type=5 "Use an HTTPS certificate that you own to serve your custom domain. After you set up your domain in Salesforce, that domain can serve your Experience Cloud sites or Salesforce Sites.").
- To create or activate a custom domain for testing in a sandbox, log in to the production org that owns the sandbox, and then go to the Domains Setup page.
- To minimize disruption for your users, provision and activate your custom domain when your site traffic is low.

Before you add your domain in Salesforce, review the [considerations](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_external_host_considerations.htm&release=264.0.0&type=5 "Review how IP address tracking works when a third party serves your custom domain. Understand what happens if you update your domain’s external configuration after you activate the domain in Salesforce, and clean up unnecessary Domain Name Service (DNS) records.") for this option, and then complete the [custom domain prerequisites](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_prereqs.htm&release=264.0.0&type=5 "Before you serve your site content with a custom domain, register a domain. To get that domain ready to serve your site content, update the Domain Name System (DNS) record to point to your org. Review your site URLs for potential conflicts, and complete the prerequisites for your chosen domain configuration option.").

1. Complete the [prerequisites](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_enable_https.htm&release=264.0.0&type=5 "If a non-Salesforce service or content delivery network (CDN) serves your domain, complete these steps before you add your domain in Salesforce. To confirm your domain ownership, update your domain’s Domain Name Service (DNS) configuration. Then work with the third-party provider to ensure access to the required HTTP protocols, configure caching and request handling, and review reverse proxy restrictions. If you’re using a third-party CDN, update the header in your CDN to track IP addresses.") for this option.
2. From Setup, in the Quick Find box, enter Domains, and then select **Domains**.
3. Click **Add a Domain**.
4. Enter the domain name.
    
    Salesforce validates ownership based on the fully qualified domain name (FQDN) that you enter when you add a domain to your org. If you get an error message, [point your custom domain to your org](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_update_dns.htm&release=264.0.0&type=5 "Before you add a domain in Salesforce, point your domain to your Salesforce org in Domain Name Service (DNS). If your custom domain uses your HTTPS Certificate or the Salesforce content delivery network (CDN) partner, add a canonical domain name (CNAME) record for your fully qualified domain (FQDN) to DNS. The CNAME record references your Salesforce org ID and your FQDN. Then, if you plan to use the Salesforce CDN to serve your Experience Cloud site on your custom domain, add a second CNAME record that our CDN partner requires."), and then wait for the changes to propagate. After you update your domain’s DNS record, it can take up to 20 hours for that change to take effect worldwide.
5. For Domain Configuration Option, select **Use a third-party service or CDN to serve the domain**.
    
    Here’s the Domain page when you select the domain configuration option to use a third-party service or CDN to serve the domain.
    
    ![Screenshot of the corresponding Setup page.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/extend_click/images/domain_add_third_party.png)
6. Enter your external host name.
    
    If you’re hosting the domain yourself, specify the public host name of your host. Typically, the third-party CDN service has a unique canonical name (CNAME). Specify this host name in the external host name field in your domain configuration.
    
    ![Warning](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/images/icon_warning.png)
    
    Warning
    
    Double check the public host name in the external host name field. If the host name is misspelled or if you don’t control the DNS record or the service of the specified host name, an attacker can potentially take over the live service of the custom domain.
    
    For example, assume that a third-party CDN serves your custom domain www.example.com and that the corresponding external host name is cdn.example.com. If you mistakenly enter cdn.exmple.com as the external host name, an attacker can register exmple.com and use that incorrect domain to serve content on your custom domain.
    
    For steps that you can take to help prevent domain takeovers, see Maintain Your Custom Domain in Salesforce Help.
7. If your domain is a registrable domain such as https://example.com, to avoid vulnerabilities during HTTP redirects, select **Allow HSTS preloading registration**.
    
    This setting adds the preload directive to the HSTS header. After you enable this setting, submit your domain at [https://hstspreload.org](https://hstspreload.org). For more information, including how to enable HSTS preloading for a domain with a subdomain, see [Enable HSTS Preloading on a Custom Domain](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_hsts_preloading.htm&release=264.0.0&type=5 "As a security best practice, enable and submit your custom domain for HTTP Strict Transport Security (HSTS) preloading. Connections can be vulnerable when HTTP requests are redirected to HTTPS. An example is a user attempting to access your custom domain using the HTTP protocol. By adding your registrable domain to the third-party HSTS preload list, supported browsers always use HTTPS, protecting your users from attacks during those HTTP redirections.").
8. For Associated Org, select the org from which you want this custom domain to serve site content.
    
    For example, to serve the sites in your production org, select **Production**. Or select a sandbox where you want to test this custom domain.
    
    This field only appears in production orgs with associated sandboxes. You can edit this field only from production orgs. For more information, see [Test Your Custom Domains in a Sandbox](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_sandbox_custom_domains.htm&release=264.0.0&type=5 "Develop and test your custom domains that serve content from your Experience Cloud sites and Salesforce Sites in a sandbox before you activate the domain in production.").
9. Save your domain.
    
    After you save your custom domain, Salesforce provisions the domain or gets it ready to be used. The provisioning process can take 4–14 hours. During provisioning, your site can be inaccessible.
    
    When that process is complete, the domain’s status on the Domains Setup page changes to Awaiting Activation and you receive an email.
    
    Newly created custom domains use HTTP, not HTTPS, until you activate the domain.
10. Delete the CNAME record that you added in DNS to verify that you own the domain.
    
    Deleting unnecessary DNS records can improve performance. Optionally, to make it easier to switch to another domain configuration option in the future, you can skip this step. Before you opt to keep the CNAME record, check with your third-party provider to make sure that their services are supported with that configuration.
11. To activate your domain, on the Domains Setup page, click **Activate** next to your custom domain name.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/images/icon_note.png)
    
    Note You edit and activate custom domains for a sandbox in production.
    
    Your site can be unavailable for 5–10 minutes, so activate your custom domain when your site traffic is low. When your site is active, the status changes from Awaiting Activation to Completed and the Current Domain Configuration Option changes to Domain is served by an external host.
12. To serve your sites via your activated domain, [add a custom URL](https://help.salesforce.com/s/articleView?id=platform.custom_url_add.htm&release=264.0.0&type=5 "To specify the site to load when users access your custom domain, add a custom URL. Optionally, you can define additional relationships between your domains and sites by mapping paths for your domain to your sites.").
13. If the domain only has legacy Site.com custom URLs unrelated to Experience Cloud sites, manually publish the affected Site.com sites via the Site.com Studio to implement the changes.
    
    If at least one Experience Cloud site or a Salesforce Site exists on the same domain as a legacy Site.com site related to an Experience Cloud site, the changes are automatically published on that domain. For more ways to configure custom domains, see [Options to Serve a Custom Domain](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_domain_config_options.htm&release=264.0.0&type=5 "Salesforce supports three HTTPS options to serve your domain. Whether you serve content for your domain via an HTTPS certificate that you own, through the Salesforce content delivery network (CDN), or through an external service, we require that you use HTTPS. When initial configuration requires that your domain is available before you enable HTTPS, Salesforce also supports a temporary non-HTTPS option.").

This diagram shows the routing of traffic when a third-party service or CDN serves content from your Experience Cloud site on your custom domain. In this example, the domain name is www.example.com, the 18-digit org ID is 00d000000000000013, and the org’s target host name is <MyDomainName>.my.salesforce.com.

The dashed line (![dashed line](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/extend_click/images/arrow_dashed.png)) represents the configuration that points your domain to your third-party service or CDN. The dotted line (![dotted line](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/extend_click/images/arrow_dotted.png)) represents routing through DNS, and the solid lines (![solid line](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/extend_click/images/arrow_solid.png)) represent user traffic flow through HTTPS. The gray lines represent traffic that originates outside Salesforce, and the blue lines represent traffic that originates in Salesforce.

![Connectivity diagram for domains that serve your site content with a third-party service or CDN.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/extend_click/images/custom_domain_third_party_updated.png)

Your custom domain (1) points to the third-party service or CDN (2). For example, you point your custom domain to the third party in DNS, or you set up a web application filter (WAF) as a proxy.

The Salesforce CNAME (3) uses the external host name of the domain in Salesforce to point to your non-Salesforce service or CDN (2). In the third-party service or CDN, the configuration points to your org’s target host name (4). To identify the domain and serve content from your site (5), Salesforce uses the value passed in the Host HTTP Header of the request from the third-party service or CDN.

#### See Also

- [Custom Domains](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt.htm&release=264.0.0&type=5 "Provide a branded experience for users who access your external-facing Salesforce content by serving your Digital Experiences or Salesforce Sites on a domain that you own, such as https://www.example.com.")
- [Considerations for Custom Domains That Use a Third-Party Service or CDN](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_external_host_considerations.htm&release=264.0.0&type=5 "Review how IP address tracking works when a third party serves your custom domain. Understand what happens if you update your domain’s external configuration after you activate the domain in Salesforce, and clean up unnecessary Domain Name Service (DNS) records.")
- [Prerequisites for a Custom Domain That Uses a Third-Party Service or CDN](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_enable_https.htm&release=264.0.0&type=5 "If a non-Salesforce service or content delivery network (CDN) serves your domain, complete these steps before you add your domain in Salesforce. To confirm your domain ownership, update your domain’s Domain Name Service (DNS) configuration. Then work with the third-party provider to ensure access to the required HTTP protocols, configure caching and request handling, and review reverse proxy restrictions. If you’re using a third-party CDN, update the header in your CDN to track IP addresses.")
- [Maintain Your Custom Domain](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_maintain.htm&release=264.0.0&type=5 "To keep your custom domain running smoothly, follow these guidelines. If you serve your domain with your HTTPS certificate, update the certificate before it expires. Optimize your domain that uses the Salesforce content delivery network (CDN). Minimize downtime when you update your domain, and take steps to help prevent domain takeover attacks. And review recommendations for communicating to your users when you change your domain.")