Skip to content
BackupSentinel
Start free trial
Documentation menu

Custom portal domain

Put the client portal on your own subdomain with two DNS records.

Last updated

On Pro, the white-label client portal can run on a subdomain of your own, such as backups.your-company.com, instead of the BackupSentinel address. You add two DNS records; BackupSentinel checks them, connects the domain and sets up HTTPS by itself.

Before you start

  • The workspace is on Pro, or in its trial.
  • You are the workspace's Owner or an Admin.
  • You can add records at the DNS provider of your domain.
  • Choose a subdomain, not your bare domain: backups.your-company.com works, your-company.com does not, because a bare domain cannot carry the record that points to the portal.

Each workspace has one portal domain, and a domain belongs to one workspace.

Connect the domain

  1. Go to Settings → Branding → Custom domain, enter the subdomain and Connect domain.
  2. Two records appear, each with a copy button. Create both at your DNS provider:
TypeNameValue
TXT_backupsentinel.backups.your-company.comThe code shown in Settings
CNAMEbackups.your-company.comThe target shown in Settings

The TXT record proves the domain is yours: keep it in place for as long as the domain is connected. The CNAME sends the portal's visitors to BackupSentinel. Copy both values from Settings: the TXT value starts with backupsentinel-verify= and is unique to your workspace.

  1. Wait. BackupSentinel checks every few minutes. When it finds the TXT record, it registers the domain, waits for the CNAME and issues the HTTPS certificate. This usually takes a few minutes after the records are published; DNS changes can take up to an hour to appear. You can close the page, and Check now checks straight away.

When the domain is connected, its status changes to Active and the Owner and Admins receive an email. New portal links use your domain. Links you created before keep working on the BackupSentinel address.

Opening the domain itself, without a portal link, sends visitors to the website in your branding settings, or shows a short page with your company name.

At your DNS provider

Most providers ask for the name relative to your domain. For backups.your-company.com, enter _backupsentinel.backups for the TXT record and backups for the CNAME. Providers that show the full name accept it as shown in Settings.

  • Cloudflare: set the CNAME's proxy status to DNS only (grey cloud).
  • Microsoft 365, GoDaddy, OVHcloud, Route 53 and most others: add the two records as they appear; the default TTL is fine.
  • A name with a CNAME cannot have any other record. Delete an existing A, AAAA or CNAME record for the subdomain first.
  • If your domain has CAA records, add one that allows letsencrypt.org, which issues the portal's certificate.

While it is connected

BackupSentinel checks an active domain once a day.

  • The CNAME stops pointing to the portal: portal links on the domain cannot be reached. The Owner and Admins get one email; restore the record and the portal comes back. Nothing else is needed.
  • The TXT record disappears: it proves the domain is still yours. You get an email, and the domain is disconnected if the record is not back within 7 days.
  • The plan no longer includes the client portal (a plan change or a suspended workspace): portal links stop working. The domain stays reserved for your workspace for 30 days, then it is released.

When it does not connect

Settings shows what it is waiting for: the TXT record, the CNAME, or the HTTPS certificate. Each record also shows whether it was found.

  • Check each record's name and value against Settings. A record created under the wrong name (the full name typed where the provider adds the domain again, for example backups.your-company.com.your-company.com) is the most common mistake.
  • If nothing is found after 14 days, the domain is marked Not connected and you get an email. Correct the records, then Disconnect and connect the domain again.
  • A domain already connected to another workspace cannot be used.

Disconnect

Disconnect in Settings removes the domain at once. Portal links on it stop working; new links use the BackupSentinel address, and links on the BackupSentinel address keep working. You can then delete the two DNS records. Connecting, activating and disconnecting are recorded in the activity log.

Limits

  • One subdomain per workspace. Bare domains and wildcard domains are not supported.
  • The custom domain serves the client portal only. Sign-in, the dashboard and report share links stay on the BackupSentinel address.
  • A custom portal domain is on Pro. The domain is released 30 days after the plan stops including the client portal.