Connect your own domain to the client portal

An address of your own goes through six stages. You do the first two. Atlas and the Atlas team do the rest, and the settings screen shows the current stage at every moment.

• You need to be an owner or administrator of the workspace in Atlas to add an address. Other members can read the records but cannot add or remove one.
• You need to be able to sign in at the company that runs DNS for your domain, or to know who can. That person does not need an Atlas account.
• A firm can have up to 3 domains of its own in use at once.
• Atlas looks for the records on its own for 7 days after you add the address, so publish them within that time.
• Publishing the records takes a few minutes. DNS can take from a few minutes to a day to show them, and the address then waits for approval.

Use a subdomain of a domain your firm owns, such as portal.yourfirm.com or clients.yourfirm.com. Choose a name that has no records yet, because a CNAME record cannot share its name with any other record.

Some providers offer ALIAS or ANAME records, or CNAME flattening, which imitate a CNAME record on the bare domain. They do not help here: they answer with addresses instead of a CNAME record, and Atlas looks for the CNAME record itself. Use a subdomain.

Avoid www and any name your website or email already uses.

1. 1

   Open Settings, then Client Delivery, and scroll to Client portal web address.

2. 2

   Under Domains you own, type the address in Domain to add and choose Add domain.

3. 3

   Atlas adds a card for the address with the status Waiting for DNS records and a table of the two records, with a Copy button for each name and each value.

If someone else manages your DNS, they can open the same screen with any role that reads Client Delivery, or you can send them the two records.

Atlas asks for two records. Publish both, at the same DNS provider, exactly as shown.

• The TXT record proves that whoever controls DNS for the address agrees to it serving your portal. Its name starts with _atlas-portal, so it never collides with other TXT records, and its value carries a code unique to your firm.
• The CNAME record makes the address lead to the client portal at portal.wrxstack.com. Atlas reads it to know the address is ready, and the certificate for the address can be issued only while it is in place.

Full names and short names

Atlas shows each name in full. Most DNS providers add your domain to whatever you type, so you enter only the part before it: _atlas-portal.portal rather than _atlas-portal.portal.yourfirm.com. Each provider guide says which form that provider wants.

Keep both records in place for as long as the address is in use.

The company where you bought the domain is the registrar. The company that answers DNS questions for it is the DNS host. They are often the same, but not always: if you moved your website to a hosting company or a website builder, that company may run your DNS now. Records work only at the DNS host.

To find the DNS host, look up the name servers of your domain. Run one of these commands in a terminal, with your own domain in place of yourfirm.com.

dig +short NS yourfirm.com
nslookup -type=NS yourfirm.com
whois yourfirm.com

Without a terminal, use one of these lookups in a browser. Enter your domain and choose the NS record type.

Name servers usually carry the name of the DNS host. Find yours in this table, then open that guide.

If the name servers belong to a company not listed here, sign in there and look for a page named DNS, DNS zone or DNS records. The two records are standard, so every DNS host can publish them.

1. 1

   Sign in at your DNS host and open the DNS records of your domain.

2. 2

   Add a TXT record. Put the name in the name or host field and the value in the value field.

3. 3

   Add a CNAME record. Put the name in the name or host field and portal.wrxstack.com in the value or target field.

4. 4

   Leave the TTL at the provider default, or choose 1 hour, and save.

5. 5

   Go back to Atlas and choose Check now on the card of the address.

Step by step instructions for 20 DNS providers, with the menus and field names of each provider and links to its own help.

Atlas checks for both records every 10 minutes for 7 days after you add the address. Check now on the card checks at once.

A check asks public DNS two questions. Is there a TXT record at the TXT name holding exactly the value shown? Does the address have a CNAME record pointing at portal.wrxstack.com? Letter case and a final dot on the target do not matter, and a value your provider split into several strings is joined before it is compared.

When a record is missing or wrong, the card names it and says what was found instead, such as a CNAME record that points somewhere else. When both are right, the status changes to Waiting for Atlas approval.

To check for yourself, ask DNS directly. These commands use your address:

dig +short TXT _atlas-portal.portal.yourfirm.com
dig +short CNAME portal.yourfirm.com

nslookup -type=TXT _atlas-portal.portal.yourfirm.com
nslookup -type=CNAME portal.yourfirm.com

An answer that shows the value means DNS has the record. No answer usually means the record is not published yet, or is under a different name.

A new record is usually visible within minutes, and can take up to a day. Resolvers remember answers for as long as the TTL allows, including the answer that a record does not exist, so a lookup made before you published can delay the next one.

The card of each address shows its status and a sentence on what happens next. These are the statuses, in the order an address moves through them.

The Atlas team approves every address a firm owns before it goes live. The team checks that the firm is a customer and that the address plainly belongs to it. A rejected address shows the reason on its card.

After approval the address shows Issuing certificate while a secure certificate is issued for it, usually within an hour. Atlas then marks it live, and the owners and administrators of your workspace are told in Atlas.

• While a domain of your own is live, invitations and emails link to it rather than to the subdomain.
• Clients sign in on the Atlas sign-in page and are brought back to your address automatically. They need no separate account for it.
• Removing a domain stops the portal answering there at once. New links fall back to your subdomain, or to the main Atlas address, and the domain record is kept for your history.

• Atlas keeps checking the CNAME record every 10 minutes, and the card shows a message if it stops pointing at the portal.
• If you stop using the address, remove it in Atlas first, then delete both records at your DNS host.

The name has your domain in it twice

Your provider added your domain to the full name you typed, which gives a name such as portal.yourfirm.com.yourfirm.com. Edit the record and enter only the part before your domain.

The CNAME record is not found, and the domain uses Cloudflare

The record is proxied. Set its proxy status to DNS only. A proxied record answers with addresses, so the CNAME record cannot be seen.

The provider refuses the CNAME record

Another record already uses the name, such as an A, AAAA, TXT, redirect or parking record. Delete it or choose another address, because a CNAME record must be alone at its name.

The TXT record holds the wrong value

Copy the value again from Atlas, including atlas-portal-verification= at the start. Do not add spaces, and add quotation marks only where your provider asks for them.

The TXT record is on the wrong name

The TXT record goes on _atlas-portal in front of your address, not on the address itself and not on your bare domain.

The CNAME record points somewhere else

Point it at portal.wrxstack.com, exactly. Do not add https:// or a path.

The address stays at Issuing certificate

Your CAA records do not allow the certificate authorities the portal uses. Add CAA records for letsencrypt.org and pki.goog.

More than 7 days have passed

The automatic checks have stopped, but Check now still works. Publish the records and choose it.

The records were added at the wrong company

The records must be at the company your name servers point to. Look up the name servers as described above, and add the records there.

The check says a lookup did not answer

The DNS servers of your domain did not reply in time. Atlas checks again on its own. If it keeps happening, ask your DNS host whether its servers are working.

• Only owners and administrators can add or remove an address, and no address goes live without approval by the Atlas team.
• The TXT value is not a password. It only shows that whoever controls DNS for the address agreed to it serving your portal, so you can share it with the person who manages your DNS.
• The portal is served on your address over a secure connection only, with a certificate issued for that address.
• Clients sign in on the Atlas sign-in page and are brought back to your address with a single-use code that expires after one minute. Your address never receives a password.
• When you stop using an address, delete its CNAME record, so the name does not keep pointing at a service you no longer use.

• Client portal guideSetting up the portal, inviting clients and deciding what they see.