Set up a custom domain for a Salesforce Experience Cloud site

Overview

A custom domain setup has three parts:

• Two DNS records. One CNAME record points your subdomain to Salesforce. A second CNAME record lets Salesforce prove that it controls the name, so that it can get a certificate.
• A domain in Salesforce. You add the domain in Setup and choose how Salesforce serves it.
• A custom URL. The custom URL connects the domain to your Experience Cloud site.

Before you begin

• Make sure that you can open Setup in the Salesforce org that hosts your Experience Cloud site.
• Make sure that you can add DNS records for your domain, or that you can reach the person who can.
• Optional: To check DNS records from a terminal, use dig. macOS includes dig.

Choose a subdomain

Use a subdomain, such as portal.example.com, rather than your root domain or www.

• A root domain, such as example.com, can’t have a CNAME record. This setup requires one.
• Your www subdomain usually serves your website. If you point it to Salesforce, your Experience Cloud site replaces your website.

Find your DNS provider

Your DNS records are managed by your DNS provider, which is often your domain registrar. They usually aren’t managed in your website platform, such as WordPress.

To find your registrar and name servers, run the following command:

whois example.com

In the output, check the Registrar and Name Server lines.

Note: Domains that were registered with Google Domains moved to Squarespace Domains. If the registrar is Squarespace Domains and the name servers end in googledomains.com, manage the DNS records in Squarespace. The domain might be in a different Squarespace account than you expect, such as the account that originally bought the domain.

Start adding the domain in Salesforce

1. In Setup, in the Quick Find box, enter Domains, and then select Domains.
2. Click Add a Domain.
3. In the Domain Name field, enter your subdomain, for example portal.example.com.
4. For the domain configuration option, select Serve the domain with the Salesforce Content Delivery Network (CDN). With this option, Salesforce issues and renews the certificate. You don’t upload a certificate.
5. Copy the two CNAME targets that the form shows.

Don’t click Save yet. Salesforce can’t save the domain until the DNS records exist.

Create the DNS records

In your DNS provider, create the following CNAME records:

Type:   CNAME
Host:   portal
Value:  portal.example.com.ORG_ID.live.siteforce.com

Type:   CNAME
Host:   _acme-challenge.portal
Value:  _acme-challenge.portal.example.com.ORG_ID.live.siteforce.com

Replace ORG_ID with your 18-character Salesforce org ID in lowercase. Where you can, paste the exact targets from the Salesforce form.

Leave the TTL at your provider’s default. Some providers expect the full name in the host field, for example portal.example.com.

Important: Create both records. The Domains page lists only the first one. Without the _acme-challenge record, Salesforce can’t issue the certificate.

Caution: Don’t change the existing records for www or the root domain. Those records serve your website.

Verify the records

Run the following commands:

dig +short CNAME portal.example.com
dig +short CNAME _acme-challenge.portal.example.com

Each command returns the matching siteforce.com target. If a command returns nothing, wait and run it again. DNS changes can take from a few minutes to several hours to propagate.

Save the domain

1. Return to the Add a Domain form. If you closed it, repeat the steps in the previous section.
2. Review the HSTS preloading checkbox, which is selected by default. Clear it unless you plan to register the domain at hstspreload.org. The option adds the preload directive to the domain’s HSTS header. It doesn’t register the domain.
3. Click Save.

Salesforce provisions the certificate after you save. Provisioning takes time, so the domain might not load over HTTPS right away.

Map the domain to your site

1. In Setup, in the Quick Find box, enter Custom URLs, and then select Custom URLs.
2. Click New Custom URL.
3. In the Domain field, select your domain.
4. In the Site field, select your Experience Cloud site.
5. In the Path field, enter /. The site then loads at the root of the domain, for example https://portal.example.com/ rather than https://portal.example.com/portal.
6. Click Save.

Salesforce also adds a custom URL with the path /vforcesite for the Visualforce site that runs alongside your Experience Cloud site. Keep this custom URL.

Verify the setup

1. In a private browser window, go to https://portal.example.com. Your site’s login page opens, or its home page if the site allows guest access.
2. Sign in as a test user and open a few pages.
3. Go to your site’s original my.site.com URL and confirm that it still loads.

Update links and integrations

Adding a custom domain doesn’t remove the original my.site.com URL. Integrations that call the original URL, such as payment webhooks, keep working without changes.

After the new domain works, update the following:

• Links to the site on your website, in email templates, and anywhere else that customers use them.
• Single sign-on. If customers sign in through an auth provider such as Google or Microsoft, add the new domain’s callback URL to the app that you registered with that identity provider. Otherwise, sign-in fails on the new domain.

Troubleshoot

Salesforce can’t validate the domain

Issue: When you click Save, an error says that Salesforce can’t validate the domain and that the CNAME record may still be processing.

Cause: The CNAME record for the domain doesn’t exist yet, or it hasn’t propagated.

Fix: Check the record with dig. When it returns the siteforce.com target, click Save again.

The domain doesn’t load over HTTPS

Issue: The domain is saved, but the browser can’t open it over HTTPS.

Cause: The _acme-challenge record is missing, so Salesforce can’t issue the certificate. Or provisioning is still in progress.

Fix: Check both records with dig. If both return their targets, wait and try again later.

You can’t find the domain in your DNS provider

Issue: The domain doesn’t appear in the account that you signed in to.

Cause: The domain is registered in a different account or with a different provider.

Fix: Run whois to find the registrar, and then sign in with the account that bought the domain. For domains that moved from Google Domains, see the note in the “Find your DNS provider” section.

Single sign-on fails on the new domain

Issue: Customers can sign in on the original URL but not on the new domain.

Cause: The identity provider doesn’t recognize the new domain’s callback URL.

Fix: Add the new domain’s callback URL to the app that you registered with your identity provider.

Get help

Kloomiyin used these steps to set up its own customer portal at portal.kloomiyin.com. If you want help with a custom domain for your Salesforce site, contact us.