Review the potential causes and troubleshooting steps for common issues that you can encounter when you set up a custom domain.
Required Editions
| Available in: both Salesforce Classic and Lightning Experience |
| Available in: Enterprise, Performance, and Unlimited Editions. |
| Applies to: Salesforce Sites and LWR, Aura, and Visualforce sites |
Unfamiliar with terms like DNS, CDN, certificate, and CNAME? See Custom Domain Terminology
| Behavior | Potential Causes and Troubleshooting Steps |
|---|---|
| When adding a domain and entering the domain name, an admin gets the error, Unable to verify the CNAME target. | The canonical name (CNAME) record is missing or incorrect in the domain’s DNS record. Verify that the CNAME record is present and correct for your fully qualified domain name (FQDN). See Point Your Custom Domain to Your Salesforce Org. |
| The change to your domain’s DNS record is still being propagated. It can take up to 72 hours for that change to take effect worldwide. Wait for propagation to finish, then try again. | |
| A custom domain is stuck in provisioning. |
Provisioning a domain can take 4–14 hours for the Salesforce content delivery network (CDN) and 4–8 hours for other options. If that time has elapsed, check your domain’s DNS record for any DNS changes. Then contact Salesforce Customer Support. |
| A custom domain has a status of Awaiting Custom URL. Provisioning didn’t start. | For custom domains that use your HTTPS certification on Salesforce servers, provisioning starts when you add the first custom URL. In this case, the status on the Domains Setup page is Awaiting Custom URL. To start provisioning, add a custom URL for the domain. |
| When attempting to visit the custom domain, users get the ERR_NAME_NOT_RESOLVED error in Chrome. |
The CNAME record is missing or incorrect in the domain’s DNS record. Verify that the CNAME record is present and correct for your fully qualified domain name (FQDN). See Point Your Custom Domain to Your Salesforce Org. |
| The domain isn’t activated in Salesforce. Check the domain status on the Domains Setup page. | |
| When users attempt to access a custom domain that uses your HTTPS certificate, they see an error that indicates a security issue. | The common name (CN) on the certificate is incorrect. A certificate is valid only if the request host name matches the certificate CN. |
|
A mismatch between the certificate and the provisioned domain name. For example, the certificate is for www.example.com and the domain name in Salesforce is example.com. Make sure that your custom domain points to its own
*.live.siteforce.com CNAME target. For example, CNAME
record for www.example.com points at
|
|
| When users attempt to access a custom domain that’s hosted by a third-party service or CDN, they see an SSL connection error. |
Verify that your proxy or CDN forwards requests to your My Domain login URL. For more information, see Prerequisites for a Custom Domain That Uses a Third-Party Service or CDN. The most common cause is the use of a site host name, such as
Also, before Spring ’26, some target host names included your Salesforce instance or Hyperforce cell. Those host names can change during maintenance, such as during an org migration. With those host names, when your instance or cell changes, your custom domain stops working. To fix this issue, work with your third party to update the target host name to your org’s My Domain login URL. |
| Make sure that the SSL certificate is installed properly on the third party’s origin server. | |
| In Setup, the custom domain isn’t reflected as the Site URL on the All Sites Setup page. | The custom domain configuration prevents the association. This issue can happen if you use a proxy or point indirectly to the *.live.sitesforce.com CNAME target. |
| Two custom domains serve the same site. Only one is shown on the All Sites Setup page. | |
| Users can’t authenticate via the custom domain with methods such as single-sign-on (SSO), connected apps, and auth providers. |
If you have two custom domains that serve the same site, verify that the authentication method is configured for both custom domains. Often when the authentication method isn’t configured for one domain, authentication methods that use the default site URL ending in *.force.com or *.my.site.com work. |
| If you deployed enhanced domains, see Restore Access to Sites After Enhanced Domains Auto-Deployment. | |
| Some users can’t connect to the site via a custom domain that uses the Salesforce CDN. | Check the common issues in the knowledge article Restore Access to Sites After Enhanced Domains Auto-Deployment. |
| Users see unexpected content when they visit a custom URL. |
If you host multiple sites on the same domain, review your site URLs for conflicts. It’s possible to configure the same URL for pages on two different sites. Let’s say that you host Site A and Site B on the same domain, https://www.example.com. Site A’s URL uses the custom URL path prefix /products. Site B serves pages from the root path and has a page with the page path /products. As a result, both Site A’s URL and Site B’s page URL are https://www.example.com/products. In this scenario, a site visitor can access the Site B page only through a navigation menu on Site B. If a site visitor navigates to https://example.com/products any other way, they’re directed to Site A. If you identify a potential conflict, either rename the site path or select a different path for serving the content on your custom domain. |
| When users visit my temporary non-HTTPS domain, the browser address bar shows a version of my internal site URL. |
This behavior is expected. Because Salesforce requires HTTPS, HTTP-only requests to your site are redirected to a working HTTPS URL. For example, an admin adds www.example.com in Salesforce as a Domain with the “Use a temporary non-HTTPS domain” domain configuration option. The admin activates the domain and adds a Custom URL to load their Experience Cloud site with the CNAME 00d000000000000013.live.siteforce.com. When users visit www.example.com, the browser’s address bar shows https://00d000000000000013.my.site.com instead of http://www.example.com. To get your custom domain name to persist in the browser’s address bar, update the temporary non-HTTPS domain to use another domain configuration option. |
| Users can’t access my custom domain via a link in a different Salesforce org. | You restrict external redirections and the custom domain isn’t on the allowlist. See Manage Redirections to External URLs. |