# Custom Domain Standard for Deployed Environments · CLOUD-02 ## Standard Metadata - Area: Security - Owner: Cloud & DevOps group - Last reviewed: 2026-09-09 - Next review due from: 2026-12-01 - Enforcement: Code review - Status: Active ## Rationale To ensure consistency, security, and operational scalability across environments, all deployed services must adhere to a standardised approach to custom domain configuration. This standard provides: - Predictable and brand-aligned access URLs - Improved compatibility with authentication mechanisms such as OAuth - Automated, secure HTTPS handling - Easier domain management and DNS configuration - Reduced operational overhead through convention and automation --- ### All externally accessible services must use a custom domain · CLOUD-02.1 · **MUST** · **DEV** All deployed environments must expose services via custom domains. Default or auto-generated platform URLs (e.g. `app-name.azurewebsites.net`, `xyz.cloudfront.net`) must not be used for direct access in any environment. This improves: - URL readability and user trust - Compatibility with enterprise SSO and OAuth - Portability across hosting providers --- ### Secure all custom domains using managed SSL/TLS certificates · CLOUD-02.2 · **MUST** · **DEV** Custom domains must be protected with automatically managed SSL/TLS certificates offered by the hosting or CDN provider. These certificates should: - Support automatic renewal - Be provisioned through DNS or HTTP challenge - Avoid manual upload workflows unless explicitly justified This ensures continuous HTTPS support without administrative overhead or security risks. **EXCEPTION** This does not apply where SSL/TLS certificates are managed by the client. --- ### Follow a standardised domain naming convention · CLOUD-02.3 · **MUST** · **DEV** All custom domains must follow a consistent structure to clearly identify: - The service name - The tenant/customer (if multi-tenant) - _Optional:_ The deployed environment #### Recommended pattern `..` ### Use centralised DNS management · CLOUD-02.4 · **SHOULD** · **DEV** DNS zones should be managed via a centralised, version-controlled configuration using Infrastructure as Code (e.g. Terraform, Pulumi, Bicep). Benefits include: - Reviewed, auditable changes - Avoidance of duplicated or conflicting records - Reproducibility across multiple environments --- ### Automate domain provisioning and validation · CLOUD-02.5 · **COULD** · **DEV** Where feasible, automate the provisioning of domains, validation of SSL certificates, and creation of DNS records as part of the deployment process. This supports: - Faster, safer deployments - Reduced manual configuration errors - Stronger alignment with GitOps and infrastructure-as-code workflows