# Custom domain setup
## 1. Add the domain
Dashboard > Branding > Custom Domains > Add. Enter `login.YOUR-DOMAIN`. Choose Auth0-managed certificates unless you have a reason to bring your own (managed = issuance + renewal handled).
## 2. DNS
Add the CNAME record Auth0 shows, pointing your hostname at the Auth0 edge. Then complete verification in the dashboard. Verification proves control of the domain.
## 3. Switchover order
1. Verify the domain first; do not point SDKs at it before verification completes.
2. Update SDK/API `domain` values to the custom domain.
3. Update Allowed Callback URLs, Logout URLs, and Web Origins to the custom domain (keep the canonical entries during the transition, remove after).
4. Check the feature-compatibility table in the docs: a few features still use the canonical domain. Do not assume everything moves.
5. Token `iss`: by default the issuer remains the canonical domain. API validators must accept the canonical issuer unless you change the issuer configuration. This is the number one post-migration 401 cause.
## Why bother
- Branding: users see your domain in the URL bar during login.
- First-party cookies: fixes Safari ITP silent-auth breakage with no code changes.
- Consistent security posture for enterprise customers inspecting URLs.
## Checklist
- Verified before cutover; both domains registered during transition.
- API issuer validation handles the canonical issuer.
- Renewal: managed certs auto-renew; self-managed need a calendar reminder.