Multiple Custom Domains Best Practices

Implementing Multiple Custom Domains (MCD) effectively requires thoughtful planning and adherence to best practices. By following these guidelines, you can ensure scalability, maintain robust security, and deliver a consistent brand experience across all your custom domains.

Verify ownership of domains 

Make sure you are ready to verify ownership of your custom domains in a timely manner. Leaving domains unverified for too long can clutter your space and complicate the management process.

Use metadata to stay organized

You can also make use of the metadata fields available for each custom domain. These fields will enable efficient searching and filtering your custom domains in a future release. In addition, MCD General Availability will release metadata to enable enhanced customization of email templates, presentation of the login UI, and even authentication logic, for example. letting you associate a brand (based on metadata) with a specific Auth0 Organization.

Implement security features

When your tenant is set up to use Multiple Custom Domains, it is crucial to implement measures that prevent potential misuse or phishing. To safeguard against end-user authentication requests involving a domain from an unrelated organization, consider these strategies:

  • Use Advanced Customization for Universal Login in your flow to implement custom logic that blocks authentication based on the domain. This can involve inspecting request parameters and then redirecting or displaying an error.

  • Modify your Auth0-hosted custom page templates to include code that inspects the domain and prevents authentication attempts from unauthorized domains.

Keep branding consistent

MCD adds another dimension to your branding efforts. Your users expect consistency across all their touchpoints with your branded products and services. MCD supports customizations across various aspects to help you achieve this:

  • Login page customization through Universal Login.

  • Invitation, password reset, and other emails through email templates.

  • Error page customization.

For comprehensive guidance, please refer to general B2B and B2C branding guidelines.