Custom domains for SaaS, explained.
How to let your customers bring their own domain: DNS, verification, certificates, routing and the failure states, with code you can copy.
47-day TLS certificates: what SaaS teams issuing certificates for customer domains must change (2026)
Public TLS certificate lifetimes drop to 200 days in 2026, 100 days in 2027 and 47 days in 2029 (CA/Browser Forum ballot SC-081), and Let's Encrypt moves to 64 and then 45 days. What SaaS teams that issue certificates for customer custom domains must change: renewal timing, ARI, monitoring, CAA, rate limits and DNS alerts.
How to add custom domains to your SaaS: the complete guide (2026)
How to let your SaaS customers use their own domain: DNS records (CNAME vs A), verification, TLS certificates, routing by Host header, renewals, apex domains, abuse and the failure states you will hit. With code and a checklist.
Apex domains for SaaS: why customers can't CNAME acme.com, and 4 ways around it
Why a root domain like acme.com can't use a CNAME, and how SaaS products support apex custom domains anyway: A records to static IPs, ALIAS/ANAME and CNAME flattening, www redirects, and verification with TXT records.
Custom domains in a multi-tenant Next.js app: routing by Host header (Next.js 16)
How to serve customer custom domains from one Next.js app: resolve the tenant from the Host header in proxy.ts (middleware.ts before Next.js 16), reject unknown hosts, build absolute URLs, handle auth and cookies across domains, cache tenant lookups, and test locally.
On-demand TLS for customer domains: Caddy, certmagic and Let's Encrypt limits (2026)
How to issue SSL certificates for thousands of customer domains automatically: on-demand TLS with Caddy and certmagic, the ask endpoint, shared storage and locking, Let's Encrypt rate limits, CAA records, renewals and the 47-day certificate future.