<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
System Status
Announcements
Announcements
Search
Search
Select Language
Knowledge Base
Knowledge Articles
Support Videos ↗
Documentation
Product Documentation ↗
Developer Documentation ↗
Product Release Notes ↗
Community
Events & Webinars
Okta Ideas ↗
Resources
Product Hub
Customer Success Hub
Product Release Update
Learning
Okta Learning ↗
Get Support
Open a Case
HomeCommunityForum
0D5WR00001w0k4b0AAOkta Classic EngineCustom URL DomainsAnswered2026-07-30T22:14:06.000Z2026-07-28T15:05:13.000Z2026-07-30T22:14:06.000Z

FerF.71645 (Customer) asked a question.

July 28, 2026 at 3:05 PM
Verify subdomain sso.example.com

If we try to create a Custom domain in customizations/brands, we encounter domain validation.

It looks like this in the screenshot

/help/servlet/rtaImage?refid=0EMWR00000cFgic

all we need to add dns records TXT, CNAME, CAA but we have a problem with adding records, according to RFC 2181 item "RFC 2181, Section 10.1 – CNAME resource records" we cannot do this, it violates DNS principles. Here is a link to the resource

https://www.rfc-editor.org/info/rfc2181/

Help what to do in this case how to validate custom domain?

Best regards!

  • 2 answers
  • 27 views

  • Mihai Negoita - Okta (Okta, Inc.)

    Hi @FerF.71645 (Customer)​ , Thank you for reaching out to the Okta Community! 

     

    This should not be a problem. Okta dashboard explicitly marks the CAA record as Optional. If your DNS provider strictly enforces the RFC and blocks adding it alongside the CNAME, you can simply skip creating the CAA record. Okta uses Let's Encrypt to issue the TLS certificate. As long as you don't have a restrictive CAA record at your root domain level (example.com) that explicitly blocks letsencrypt.org from issuing certificates, the issuance will succeed automatically.

     

    Technical Breakdown

    • TXT Record: Placed on host _acme-challenge.***** Because this is a distinct subdomain node from sso.example.com, it does not violate RFC 2181 CNAME restrictions.
    • CNAME Record: Placed on host sso.example.com pointing to the assigned .customdomains.okta.com target.
    • CAA Record: Adding a CAA record to sso.example.com alongside a CNAME record directly violates RFC 2181. Because Okta marks this record as optional, omit the CAA record entirely.

     

     

    Action Steps

    1. Add the TXT record for host _acme-challenge.******.
    2. Add the CNAME record for host sso.example.com.
    3. Do not create the CAA record.
    4. Click Next in the Okta console after DNS propagation completes.

     

     

     

    If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you. 

     

    Hope my answer helps! 

     

    --

    Help others in the community by liking or hitting Select as Best if this response helped you.

    Securing AI agents across your org? Join our upcoming Ask Me Anything on 8/5 about Okta for AI Agents. Ask our expert questions.

    Expand Post
    Selected as Best

  • Mihai Negoita - Okta (Okta, Inc.)

    Hi @FerF.71645 (Customer)​ , Thank you for reaching out to the Okta Community! 

     

    This should not be a problem. Okta dashboard explicitly marks the CAA record as Optional. If your DNS provider strictly enforces the RFC and blocks adding it alongside the CNAME, you can simply skip creating the CAA record. Okta uses Let's Encrypt to issue the TLS certificate. As long as you don't have a restrictive CAA record at your root domain level (example.com) that explicitly blocks letsencrypt.org from issuing certificates, the issuance will succeed automatically.

     

    Technical Breakdown

    • TXT Record: Placed on host _acme-challenge.***** Because this is a distinct subdomain node from sso.example.com, it does not violate RFC 2181 CNAME restrictions.
    • CNAME Record: Placed on host sso.example.com pointing to the assigned .customdomains.okta.com target.
    • CAA Record: Adding a CAA record to sso.example.com alongside a CNAME record directly violates RFC 2181. Because Okta marks this record as optional, omit the CAA record entirely.

     

     

    Action Steps

    1. Add the TXT record for host _acme-challenge.******.
    2. Add the CNAME record for host sso.example.com.
    3. Do not create the CAA record.
    4. Click Next in the Okta console after DNS propagation completes.

     

     

     

    If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you. 

     

    Hope my answer helps! 

     

    --

    Help others in the community by liking or hitting Select as Best if this response helped you.

    Securing AI agents across your org? Join our upcoming Ask Me Anything on 8/5 about Okta for AI Agents. Ask our expert questions.

    Expand Post
    Selected as Best

  • FerF.71645 (Customer)

    Thank you, you helped me a lot to understand.

Loading
Verify subdomain sso.example.com