Per-Tenant DNS Records Favored Over Wildcards for Customer Storefront Domains
The article argues that customer-owned storefront domains should get explicit per-tenant DNS records rather than relying on wildcards in the SaaS operator's zone. A wildcard under the operator's domain cannot verify ownership of a customer's domain, while per-tenant records give onboarding services concrete state to read back and reconcile. The author treats domain onboarding as a consistency problem, separating desired state, observed DNS state, and ownership verification, plus delivery evidence for SPF, DKIM and DMARC. The piece lists three design risks: false readiness, reconciliation drift, and ownership boundary mistakes. It also notes that these are design considerations rather than reports of any provider incident.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
Discussion (0)
Log in to join the discussion and vote.
Log in