Last Updated on February 7, 2025 by Rakesh Gupta
Big Idea or Enduring Question:
-
How can you configure a custom domain for an Experience Cloud site?
Objectives:
After reading this blog, you’ll be able to:
- Understand different methods for verifying and provisioning a custom domain
- Understand CA-Signed Certificates and their role in domain security
- Learn about Salesforce CDN and its benefits
- Configure a custom domain for your Experience Cloud site
- Set up a custom domain in a Sandbox environment
- Correctly map a custom domain to your Experience Cloud site
- And much more!
Business Use case
Olivia Bennett, a Junior Developer at Gurukul on Cloud (GoC), is part of a team tasked with building an Experience Cloud site for the company’s help portal. The goal of this portal is to serve as a self-service knowledge hub, enabling customers to access resources, learn about GoC’s products, and troubleshoot issues independently.
The team has successfully developed and deployed the Experience Cloud site (Name – Help), making it accessible via the default Salesforce domain: https://gurukuloncloud.my.site.com/s/
While the portal is fully functional, it currently uses Salesforce’s default domain structure, which is not ideal for branding, user experience, or SEO optimization.
To align with GoC’s branding strategy, management has requested a custom domain to provide a more seamless and professional experience for customers. Instead of using the Salesforce-provided domain, they want the portal to be accessible via: https://help.gurukuloncloud.com/
What Is a CNAME Record?
Before we start configuring a custom domain for Experience Cloud, which typically takes no more than 30 minutes at least in my case, it is important to understand the basic terminology and the tools required for configuration.
When you create an Experience Cloud site, it by default runs under the site.com or force.com domain (in my case, gurukuloncloud.my.site.com). This doesn’t look good from a branding and SEO perspective.
To address this, we use Salesforce CDN, which requires a CNAME. Salesforce CDN only serves subdomains, such as help.gurukuloncloud.com or docs.automationchampion.com. When using Salesforce CDN, Salesforce cannot serve a registrable domain like automationchampion.com.
A CNAME (Canonical Name) or vanity URL allows businesses to mask Salesforce-hosted Experience Cloud sites with a branded URL. Instead of a default Salesforce domain, you can set up a CNAME like help.gurukuloncloud.com, ensuring all Experience Cloud pages and content reflect your brand.
This enhances trust, security, and user experience by assuring visitors that they are interacting with an official, branded site.
What Is Salesforce CDN?
Salesforce CDN (Content Delivery Network) is a globally distributed network of servers designed to improve the performance, speed, and security of Experience Cloud sites and other Salesforce-hosted content. It helps deliver assets like images, stylesheets, scripts, and pages efficiently by caching them closer to the end users.
The Salesforce CDN includes an image optimization feature that makes your site pages load faster for guest users, whether they’re viewing your site on their phone, tablet, or desktop computer. In addition, the Salesforce CDN comes with configurable availability pages. You can display a custom Service Not Available page when your site is down or a custom Too Many Requests page when your site is in high demand.
Key Benefits of Salesforce CDN:
- Improved Performance: Reduces page load times by serving cached content from the nearest server location.
- Enhanced Security: Protects against DDoS attacks and ensures secure content delivery.
- Better Scalability: Handles high traffic efficiently without impacting site performance.
- SEO & Branding Benefits: Works seamlessly with custom domains and CNAMEs, improving brand consistency and search engine ranking.
- Reduced Salesforce Server Load: Offloads content delivery to CDN servers, ensuring better system performance.
Salesforce CDN is the recommended option for custom domains that serve Digital Experiences, including those built with Experience Cloud, Commerce, and Industries licenses. For Commerce LWR sites or sites hosted on Experience Delivery, the domain uses Cloudflare as the CDN partner service. Other domains use Akamai as the CDN partner.
Things to Remember
- To minimize the impact to your users, activate the Salesforce CDN when your site traffic is low.
- The maximum URI size limit for the Akamai platform is 8892 bytes. This limit allows close to 9,000 characters on the URI path. Â
- The maximum URI size limit for Cloudflare is 16 kilobytes.
- Orgs that host LWR Commerce sites or sites hosted on Experience Delivery and use the partner, Cloudflare, get 5 branded certificates and no limit on traffic per year.
- Orgs that purchase Experience Cloud licenses and use the partner, Akamai, get 10 Experience Cloud CDN single certificate domains and 48 terabytes (TB) of traffic per year.
- Web application firewall and rate-limiting security features are included for sites that use the Salesforce CDN with single domain certificates.Â
- When you enable the Salesforce CDN, your domain uses either Akamai or Cloudflare for optimized content delivery.
- Only Apex methods annotated with @AuraEnabled(cacheable=true scope=’global’) are cached. Caching public data from annotated Apex methods in managed packages is enabled by default.Â
Reference – Salesforce help article
What is a CA-Signed Certificate?
A Certificate Authority (CA) is a trusted entity that issues digital certificates to verify the authenticity of websites. When you visit a site with HTTPS and a padlock icon in the URL bar, it means the site has been validated by a CA. Conversely, a Not Secure warning indicates the absence of a valid SSL certificate.
A CA-signed certificate is an SSL certificate issued by a trusted third-party CA like Comodo, Let’s Encrypt, or GlobalSign. To obtain one, you generate a Certificate Signing Request (CSR), submit it to a CA, and upload the issued certificate back into system (Salesforce).
Benefits of CA-Signed Certificates:
- Greater Security Control:Â Choose encryption levels and advanced validation (e.g., Extended Validation (EV) certificates).
- Wildcard Support:Â Secure multiple subdomains (e.g.,
docs.gurukuloncloud.com,docs.gurukuloncloud.com) with a single certificate. - Regulatory Compliance:Â Necessary for organizations with strict IT security policies that mandate specific SSL providers.
CA-Signed Certificates vs. Salesforce CDN-Managed SSL: Understanding the Best Approach
Choosing between a CA-Signed Certificate and Salesforce CDN-Managed SSL depends on your organization’s security needs, budget, and technical capabilities. While CA-signed certificates offer greater control and wildcard support, they require manual management. On the other hand, Salesforce CDN-Managed SSL is a hassle-free, automated solution that enhances performance and security at no additional cost.
Here’s a comparison to help you decide:
| Feature | CA-Signed Certificate | Salesforce CDN-Managed Certificate |
|---|---|---|
| Cost | Paid (varies by CA) | Free |
| Management | Manual renewal & upload | Fully automatic |
| Wildcard Support | Yes | No |
| Security Control | Full control over encryption & provider | Salesforce-managed |
| Ease of Setup | Complex (requires CSR, CA purchase, upload) | Simple (Salesforce handles it) |
| Performance | Depends on SSL provider & setup | Optimized with CDN acceleration |
For most businesses, Salesforce CDN-Managed SSL (Via Let’s Encrypt) is the best choice due to its automation, zero cost, and enhanced performance. However, if you require specific security settings or wildcard support, a CA-signed certificate may be necessary. We will use Salesforce CDN to configure custom domain for experience cloud site.Â
Where Can You Configure It?
Adding a custom domain to your Experience Cloud site is available only in Enterprise, Performance, and Unlimited editions. This feature cannot be configured in a Free Developer Edition org.
Additionally, configuring a custom domain is only possible in your production org. However, it is possible to point a custom domain to one of your sandboxes if needed. For that, when adding a custom domain, use the Associated Org drop-down to select the appropriate sandbox or production org before proceeding with the configuration.
Automation Champion Approach (I-do):
By now, you have learned the basics required before configuring a custom domain for your Experience Cloud sites. With that said, we will perform the steps below to solve the business use case mentioned above.
Now, take a minute to pause here, as there are a few prerequisites that must be met, as mentioned below:
- You must have a domain.
- You need access to the DNS to make changes to the domain settings.
Ready now? Let’s get startedÂ
Step 1: Register Your Domain
Before configuring a custom domain for your Experience Cloud site, you must have a registered domain. In this case, we are using Gurukuloncloud.com.Â
Registering a domain means purchasing and owning a unique web address (e.g., Gurukuloncloud.com) from a domain registrar like GoDaddy, Namecheap, SiteGround, etc. This gives you control over the domain and allows you to configure it for various purposes, including linking it to your Salesforce Experience Cloud site.
I manage my Gurukuloncloud.com nameservers through SiteGround, which means I will use SiteGround to make changes to the DNS entries. Any required modifications, such as adding CNAME or A records, will be done through SiteGround’s DNS management panel.
Step 2: Point Your Domain to Salesforce
- Click Setup.
- In the Quick Find box, type Domains, and then select Domains.
- Click Add a Domain
- Enter the following details
- Domain Name: help.gurukuloncloud.com
- Domain Configuration Option: Serve the domain with the Salesforce Content Delivery Network (CDN)
- Associated Org: Production
- Enter the following details
- Now, let’s jump to Siteground cPanel to make a few entries in Gurukuloncloud.com DNS.
- The first entry ensures that when someone visits Gurukuloncloud.com, their request is routed to Salesforce’s hosting service for your Experience Cloud site.
- The second entry is required to verify SSL certificate ownership with Salesforce. The Acme Challenge CNAME is used by Let’s Encrypt (or another SSL provider) to confirm that you own the domain before issuing an SSL certificate.
- Now, wait for the DNS server to propagate the changes. This process can take anywhere from 24 to 48 hours, though in my case, it took less than 5 minutes. You can validate the propagation by using this site: https://www.whatsmydns.net/#CNAME/
- The first entry ensures that when someone visits Gurukuloncloud.com, their request is routed to Salesforce’s hosting service for your Experience Cloud site.
- Now, we’re back in Salesforce, right where we left off at Step 3. Simply click on Save.
- Now, let’s wait for Salesforce to complete the provisioning. Upon completion, you will receive an email that looks like the screenshot below.
Step 3: Add a Custom URL in Salesforce
The final step in setting up your Experience Cloud site with a custom domain is to configure the Custom URL in Salesforce. This step ensures that your Experience Cloud site is accessible via the custom domain we registered. The process is fairly straightforward just follow the steps below:
- Click Setup.
- In the Quick Find box, type Custom URLs, and then select Custom URLs.
- Click on New Custom URL, and enter the following details:
- Domain: help.gurukuloncloud.com
- Site: Help (This is the name of the site I created)
- Path: /
- Site Primary Custom URL: True
- Click the Save to save your changes.
Step 4: Update Salesforce CDN Setting
Salesforce Content Delivery Network (CDN) settings help optimize the performance, security, and availability of your digital assets. While this step is optional, it is highly recommended for organizations that require enhanced performance, security, and scalability for their Salesforce-hosted assets.
You may need to modify Salesforce CDN settings in the following scenarios:
- You want to create or update firewall rules to control incoming and outgoing traffic.
- You need to enable image optimization to improve page load speeds and reduce bandwidth consumption.
- You aim to accelerate and secure HTTP traffic for a better end-user experience.
- Click Setup.
- In the Quick Find box, type Domains, and then select Domains.
- Click on Edit CDN Settings.
- You can now access Salesforce CDN Settings for your domain.Â
Proof of Concept
With the custom domain in place, going forward,, if any user opens help.gurukuloncloud.com, it will load the Salesforce Experience Cloud site we built seamlessly.
This ensures that:
- The CNAME record is correctly pointing to Salesforce.
- The Experience Cloud site is mapped to the custom domain.
- The SSL certificate is active, hence allowing for secure access.
By doing so, we have associated a custom domain with our Salesforce Experience Cloud site and mapped that to a professional and branded URL
Formative Assessment:
I want to hear from you!
What is one thing you learned from this post? How do you envision applying this new knowledge in the real world? Feel free to share in the comments below.
I want to take a moment to express my sincere appreciation for this outstanding article. Your detailed breakdown of the process, coupled with example screenshots to illustrate your explanations, made this an incredibly valuable resource.
Recently, I was working with clients who required a secure, high-performance solution for custom domain implementation while ensuring low latency for their Experience Cloud sites and your insights on SSL configurations, DNS setup, and best practices for domain authentication were especially instrumentalfor the solution that my client needed.
Your content consistently sets a high bar in the Salesforce community, and this article is yet another testament to your commitment to empowering professionals like me. Thank you for your contributions, and please keep up the phenomenal work!
Thank you so much for your kind words, sir! It truly means a lot coming from someone i admire. I’m glad the article was helpful, and I appreciate your support.