Add a custom domain name

A custom domain enhances your brand and helps your customers more easily find your support resources. After you provision your website and acquire your domain name, get an SSL certificate to set up a custom host name. When you purchase the SSL certificate, use the following wizard experience to link your website to a custom domain. You can add only one custom domain name to a website.

To learn about the roles required to perform this task, see Admin roles required for website administrative tasks.

1. Open the Power Platform admin center.

2. Under Resources, select Power Pages sites.

3. Select the site to which you want to add a custom domain. Select Manage from the main menu. A page opens with details about your site.

4. In the Site Details section, select Connect Custom Domain.

5. A side panel appears. In the Choose a SSL certificate section, select one of these options:

   • Add Microsoft Managed certificate: Select this option to use a managed certificate provided by Microsoft. This certificate is automatically provisioned, configured, and renewed by Microsoft, so you don't need to purchase or manage your own SSL certificate.
   • Upload a new certificate: Select this option to upload the .pfx file if you didn't upload it earlier. Select the upload button under File to select the .pfx file. After selecting the file, enter the password for your SSL certificate in the Password field.
   • Use an existing certificate: Select this option to choose the correct certificate from the drop-down list.

   Note

   The Add Microsoft Managed certificate option isn't available if either Content Delivery Network (CDN) or Web Application Firewall (WAF) is enabled. The add option isn't displayed when CDN or WAF are enabled.

   

   

   Note

   If you're using your own SSL certificate, the SSL certificate must meet all the following requirements:

   • Signed by a trusted certificate authority.
   • Exported as a password-protected PFX file.
   • Contains private key that's at least 2,048 bits long.
   • Contains all intermediate certificates in the certificate chain.
   • Must be SHA2 enabled; SHA1 support is being removed from popular browsers.
   • PFX file must be encrypted with TripleDES encryption. Power Pages doesn't support AES-256 encryption.
   • Contains an Extended Key Usage for server authentication (OID = 1.3.6.1.5.5.7.3.1).

   The steps to export SSL certificate as a password-protected PFX file might vary depending on your certificate provider. Check with your certificate provider for recommendation. For example, certain providers might suggest using OpenSSL 3rd party tool from OpenSSL or OpenSSL Binaries sites.

6. Select Next.

7. Enter the hostname you want in the Host Name field (for example www.contoso.com).

   Note

   • You can have only one custom domain name for a website.
   • To create a custom host name, you need to create a CNAME with your domain provider that points your hostname to the Power Pages site URL of your website.
   • You can't have CNAME mapping for root domain in DNS srver. Ensure you aren't selecting root domain as hostname.
   • If you just added a CNAME with your domain provider, it takes some time to propagate to all DNS servers. If the CNAME mapping isn't propagated and if you try to add hostname here, you will see an incorrect URL mapping error, please retry after sometime.
   • The CNAME record used for custom domain configuration must be publicly resolvable. Power Pages can't validate DNS records that exist only in private or internal DNS zones, and will cause custom domain setup to fail.
   • Before adding the custom domain, check that the CNAME resolves by using a public DNS tool (for example, nslookup or dig). If the record can't be resolved publicly, Power Pages can't validate it. Learn more about how to verify CNAME in Verify your CNAME.

8. Select Next.

9. This step is applicable for a Content Delivery Network or Web Application Firewall enabled site. In the Validate the domain section, copy the Record type, Record name, and the Record value and create a TXT record with your domain provider. For detailed instructions, see Add the TXT record for domain validation.

   Note

   To successfully bind your custom domain, ensure there's no TXT record in your DNS named asuid.<customDomain>. If such a record exists, delete it and try binding the domain again. For example, if your domain is www.contoso.com, check for a TXT record named asuid.www.contoso.com. If found, remove it before retrying the domain configuration.

10. Select Next.

11. Review the information comparing the Custom host name and the SSL certificate (subject), and then select Next to begin creating the SSL Binding.

12. After the configuration is complete, a success message appears.

    Note

    Microsoft managed certificates can take few minutes for successful configuration.

    You can now go to {Custom Domain Name} to access this website.

13. Select Close.

Verify your CNAME

After you add a CNAME record at your DNS provider, DNS servers take some time to sync the record. Check whether the CNAME mapping is publicly visible by following these steps:

In the following commands, replace <hostname> with your host name.

• On Windows, open Command Prompt, and then run the following command.

  
   nslookup -type=CNAME <hostname> 
  

• On macOS or Linux, run the following command.

  
   dig CNAME <hostname>
  

Add the TXT record for domain validation

This step verifies you own the domain before Power Pages routes traffic through Azure Front Door.

What you'll need

In the Power Platform admin center, copy these values from the Custom domain setup panel:

• Record type: TXT
• Record name: for example, _dnsauth.www
• Record value: for example, abc123def456...

Instructions for your DNS provider

General steps for any DNS provider:

1. Sign in to your DNS management console.
2. Find the option to add DNS records.
3. Create a new TXT record with:
   • Record Name: The record name from admin center.
   • Record Type: TXT
   • Record Value: The record value from admin center.
4. Save the record.

Learn more in Create DNS records and zones using the Azure portal if you use Azure DNS.

Verify your TXT record

After adding the record, verify it's publicly visible.

Option 1: Command line

Replace <hostname> with your domain name. Run the command for your operating system.

• On Windows, run

 nslookup -type=TXT _dnsauth.www.<hostname>

• On macOS or Linux, run

dig TXT _dnsauth.www.<hostname> +short

Option 2: Online tools

• MXToolbox TXT Lookup
• Google Admin Toolbox

If the record appears, return to admin center and select Refresh.

When you add a TXT entry with your domain provider, it takes some time to propagate to all DNS servers. Select Refresh to validate the custom domain. When the information is validated, the Next button is activated.

Change current custom domain name

To change your existing custom domain name:

1. Open the Power Platform admin center.

2. Under Resources, select Power Pages sites.

3. Select the site where you want to change the custom domain. Select Manage from the main menu. A page opens with details about your site.

4. In the Site Details section, select the pencil icon to the right of your custom URL.

5. A side panel appears.

   1. Select and delete the current SSL binding.
   2. Select and delete the current SSL certificate.
   3. Select and delete the current assigned hostname.

To configure your new domain, follow the instructions in Add a custom domain name.

Moving between user-managed certs and Microsoft-managed certificates for existing domain

To change the SSL certificate for your existing custom domain name:

1. Open the Power Platform admin center.

2. Under Resources, select Power Pages sites.

3. Select the site where you want to change the custom domain. Select Manage from the main menu. A page opens with details about your site.

4. In the Site Details section, select the pencil icon to the right of your custom URL.

5. A side panel appears.

   1. Delete SSL binding if one exists.
   2. Delete SSL certificate if one exists.

6. To reconfigure your domain, follow the same instructions outlined in Add a custom domain name.

Renew or reissue SSL/TLS certificate for Power Pages

To renew or reissue an SSL/TLS certificate that covers your portal's custom domain name, follow these high-level steps:

STEP 1: Generate Certificate Signing Request (CSR).

To renew an SSL/TLS certificate, generate a new CSR.

Generate a new CSR when renewing your SSL/TLS certificate. This process creates a new, unique key pair (public and private keys) for the renewed certificate.

STEP 2: Sign in to your preferred Certificate Authority (CA) website and fill out the renewal form.

On the Expiring certificates page, next to the certificate that needs to be renewed, select Renew now.

A certificate doesn't appear on the Expiring Certificates page until 90 days before it expires.

STEP 3: Your CA issues the SSL/TLS certificate.

Once approved, the CA issues and sends the renewed certificate to the certificate contact via email. You can also download the renewed certificate from the CA website.

STEP 4: Install your renewed SSL/TLS certificate (preferably on the machine from step 1 where you installed the CSR, which auto-associates the private key so that you can later export the .PFX file). While exporting the PFX file on Windows, just ensure that the export is a password-protected PFX file, encrypted using triple DES as shown in the following image:

When you have the renewed (reissued) certificate .PFX file, select the edit icon (pencil icon) beside your custom domain in Power Portals admin center to replace your old certificate.

1. Upload your renewed certificate .pfx file by choosing New from the Edit Custom Domain pane.

2. After the upload, delete the existing binding with the old certificate and create a New binding as shown in the following image. Selecting New opens a popup where you can choose your preferred host name and your new certificate for this binding.

Legend:

1. To delete the existing binding, select the ellipse, and then choose Delete.
2. Select the + New button to add a new SSL certificate.

See also

Configure SSL certificates and custom domain names