You are here:
Configure Self-Hosted DNS for Branded Domains Routed Through a Proxy
Custom domains hosted by Marketing Cloud Engagement route directly to Engagement servers by default. If you have a proxy or web application firewall (WAF) for all your domains, self-host DNS and point the proxy at the Domain Specific Endpoint (DSE) so that Salesforce can provision and renew SSL certificates for the domain.
See DNS Record Maintenance for Your Marketing Cloud Engagement Custom Domain and Email Sending to self-host or Custom Subdomain Delegation to delegate DNS.
If your security policy does not allow bypassing your WAF or if you need to use a proxy for other reasons, understand these constraints:
- DNS can’t be delegated to Salesforce, so you must self-host DNS.
- There are two separate connections to manage for end-to-end connectivity and security:
- The client-to-proxy connection: From a client or browser to your proxy
- The proxy-to-origin connection: From your proxy to the Engagement server
- The proxy must route to the DSE so that the proxy-to-origin connection can be secured and its SSL certificate can be renewed. The proxy setup can still cause the UI-based SSL certificate installation and renewal to fail.
- When you use a Salesforce-supplied SSL certificate for the proxy-to-origin connection, the proxy must not block the DigiCert or Amazon Certificate Manager certificate authorities (CAs) from performing token-based Domain Control Validation (DCV) using the Engagement fileshare.
- Order of operations: The proxy must not require the proxy-to-origin connection to be secured before the client-to-proxy connection is secured and traffic is routed end to end. This order lets Salesforce automatically verify that traffic reaches the Engagement server and secure the proxy-to-origin connection when the custom domain is first configured, or later secured, in the Engagement UI. First secure the client-to-proxy connection with an SSL certificate on the proxy, and make sure that traffic is routed to the Engagement server.
-
For end-to-end connectivity, configure the proxy to point to the DSE on the
proxy-to-origin connection.
- From Setup, in the Quick Find box, enter ssl, and then select Domain SSL Certificates.
- To find the DSE for your domain, from the action dropdown menu on your domain’s row, select View Self-Hosted DNS Settings.
-
Point the CNAME record to the Domain Specific Endpoint (DSE) for your custom
domain.
Even though a correctly configured A record doesn’t report a DNS status error, we strongly recommend using a CNAME record that points to the DSE instead. Routing to the DSE instead of the Engagement server IP address helps ensure reliable SSL certificate provisioning and renewals for end-to-end security, along with end-to-end connectivity.
Salesforce can then update the hosting server without requiring a change to your DNS. -
For end-to-end security, install an SSL certificate on the proxyTo secure the
client-to-proxy connection and display HTTPS on your customers’ clients and browsers when
they reach your custom domain, on the domain’s row, select Secure This
Domain for installing .
- To secure client-to-proxy connection and display HTTPS on your customers’ clients and browsers when reaching your custom domain, install an SSL certificate on the proxy .
-
To secure your custom domain, from the action dropdown menu on your domain’s row,
select Secure This Domain
Make sure that the proxy attempts HTTPS on the proxy-to-origin connection.
The Engagement server checks end-to-end connectivity and security every 7 days and reports them through the DNS status and SSL status, respectively, on the Domain SSL Certificates summary page. The end-to-end security probe verifies that valid SSL certificates exist on both the proxy and the Engagement server. The DNS status shows an error when:- A correct CNAME record isn’t found.
- A CNAME record is found, but its value doesn’t match the DSE.
- A valid A record isn’t found.
- A valid A record is found, but its value doesn’t match the server IP address that belongs to the domain.
Did this article solve your issue?
Let us know so we can improve!
