Custom domains

Every app has an address on Tunori's apps domain, such as sales-dashboard.tunoriusercontent.com. An organization Admin can also put an app on a domain of your own, such as app.acme.com or acme.com itself. Tunori issues and renews the certificate for it, so the app opens over HTTPS there like anywhere else, and visitors who open the Tunori address are sent to your domain instead. One custom domain per app; the custom domain is included in the hosting fee.

Adding a custom domain, like making an app public, requires that your organization's billing account has been topped up at least once.

Adding a domain

1. Open the app's Settings page and choose Add domain under Custom domain. Enter the name without https://, for example app.acme.com. Names that contain "tunori" are not accepted.

2. Tunori shows the DNS records to create at the provider that manages your domain (where you bought it, or your DNS host). There are two for every name: the proof that the domain is yours, and the record that sends visitors to Tunori, which depends on the kind of name:

   Record	For	Name	Value	Why
   TXT	every name	_tunori-verify.app.acme.com	tunori-domain-verification=… (a code shown to you)	Proves that the domain is yours.
   CNAME	a subdomain (app.acme.com)	app.acme.com	custom.tunoriusercontent.com	Sends visitors to Tunori.
   A	a root domain (acme.com)	acme.com (@ at most providers)	the IP address Tunori shows	Sends visitors to Tunori; DNS does not allow a CNAME at a root domain.

   The Custom domain section lists exactly the records your name needs, with the values to copy, and puts a green tick next to each record once it has been found.

3. Wait for the records to take effect (seconds to an hour, depending on the provider) and choose Check now, or just leave the page: Tunori looks for the records every few minutes for a week. Each row of the table then shows what the last check found: a green tick and Found, or Not found, Different value (a record exists but points elsewhere or carries another code) or Could not check (your DNS did not answer; Tunori tries again shortly).

4. Once both records are found, the status changes to Issuing certificate. Tunori issues the certificate within a few minutes, at most about an hour; until then browsers show a security error on the domain. The domain never moves on while one of the records is missing or wrong.

5. Active: the app is served on your domain, and the Tunori address redirects there.

A few rules, because the certificate cannot be issued otherwise:

• The name must have no other A or AAAA record than the one pointing to Tunori. Tunori has no IPv6 address, so remove any AAAA record. For a root domain this means removing the records of whatever was there before: the whole root domain then shows the app.
• Use plain DNS. If your provider can proxy traffic (at Cloudflare, the orange cloud), turn it off for this name ("DNS only"): otherwise the name points at the provider, not at Tunori.
• If the zone has a CAA record, it must allow Tunori's certificate authority to issue certificates: CAA 0 issue "pki.goog". Zones without a CAA record need nothing.
• www.acme.com and acme.com are two names. Put the app on one of them and have your provider redirect the other (most offer a redirect or forwarding record).

Below the table, the Custom domain section also says in plain words what the last check found: a record that is missing or has a different value, a name that still points elsewhere, or what is holding up the certificate. If the records are not found within seven days, or the certificate cannot be issued within a day, the domain shows as Failed; fix what is reported and choose Check again to start over.

While the domain is active

Tunori checks the records once a day and warns you on the Settings page when one has disappeared; the domain keeps working until its certificate would have to be renewed. The certificate itself is renewed by Tunori without anything to do on your side, as long as the records stay in place.

Signing in works on the custom domain the way it does on the Tunori address: members of your organization sign in with their Tunori account, and a public app opens without signing in. Anything the app keeps in a visitor's browser is kept per address, so a visitor who used the Tunori address before starts afresh on the custom domain.

Inside Tunori, the app is still shown at its Tunori address, and the builder's preview is not affected by the custom domain.

Removing a domain

Choose Remove next to the domain on the Settings page (admins only). The app stops answering on the domain within half a minute, the Tunori address stops redirecting, and the certificate is deleted. You can then remove the DNS records at your provider. Deleting the app removes its domain as well.