Point your domain at the client portal

Your client portal runs on your own domain rather than ours. Clients see your name in the address bar, links you send match the brand on the page, and nothing in the flow tells your client which vendor you buy software from.

What this does

Adds one record to your DNS so requests for your portal address reach the platform, and issues a certificate for that name so the connection is private.

How to do it

1. In the tenant admin, open Branding and enter the hostname you want. Use a subdomain you control, such as clients.youragency.com.au. Do not use your apex domain, because your website already answers there.
2. Copy the record shown on screen. It is a single CNAME.
3. Add that record at your DNS provider, exactly as shown, with no trailing dot added or removed.
4. Wait for the status on the same screen to move from pending to active. It usually takes minutes. It can take longer if your provider caches aggressively, and the screen tells you what it last saw rather than guessing.

What proves it worked

Open your portal address in a private browsing window. Three things have to be true at once: the page loads, the address bar shows a lock, and the certificate names your hostname. The admin screen asserts the same three and shows the certificate name it observed, so you are reading a check rather than an assumption.

A page that loads over plain HTTP is not done. A page that loads with a certificate warning is not done either.

When it does not work

If the status sits at pending for more than an hour, the record is usually wrong in one of two ways. Either it was added at the apex rather than at the subdomain, which most providers show as a bare @, or the provider appended your domain to a value that already ended in it, producing a doubled name. Both show on the admin screen as the value we actually resolved, so compare that string against the one we asked for.

If your DNS is behind a proxy that hides the record, turn the proxy off for this hostname until the certificate issues, then turn it back on.

Related

Sending-domain authentication is the next step and it uses a different set of records. Do them in order, because a sending domain that authenticates before the portal resolves will pass its own check and still send links nobody can open.