How to Use CNAMEs and Signed URLs for Secure, Tenant-Safe Asset Delivery

A technical guide explains how platforms can let customers serve assets under their own subdomains by pointing a CNAME at the platform's asset host, while keeping access control entirely within signed URLs. The author emphasizes that a custom hostname is purely cosmetic routing and does not isolate one tenant's objects from another's — bucket policies and signing logic must still enforce per-tenant checks. During customer onboarding, the DNS record write should be implemented as an idempotent upsert to safely handle network timeouts and retry scenarios without creating duplicate records. A minimal Python example demonstrates the pattern, using exponential backoff for rate limits and a unique idempotency key on the DNS upsert call. The guide also warns that presigned download URLs must be returned as-is, without appending platform authorization headers, and that tenant-object verification must occur before any URL is issued.