> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuraltrust.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Custom domain

> Configure the NeuralTrust application hostname and distinguish it from runtime ingress domains.

NeuralTrust uses two separate kinds of custom hostname:

* **Application hostname** — the browser-facing NeuralTrust web application, such as `ai.example.com`.
* **Runtime hostnames** — TrustGate, TrustGuard, data-plane APIs, and other Hybrid workloads exposed through Kubernetes Ingress or OpenShift Routes.

Changing one does not change the other.

## Application hostname

### Set up

1. Open **Platform settings → Domains → Custom domain**.
2. Enter a subdomain you control, such as `ai.example.com`. Apex or root domains such as `example.com` are not supported.
3. Copy the single CNAME record shown by NeuralTrust and create that exact CNAME in your DNS provider.
4. Wait for the CNAME to resolve, then return to NeuralTrust to complete setup.

### DNS and TLS

The custom hostname must remain a CNAME to the exact target shown in the application. NeuralTrust provisions TLS after that CNAME resolves. Keep the CNAME in place while the hostname is active.

### SSO callback

If your identity provider restricts callback or redirect URLs, add the custom hostname with the callback path shown in your [SSO configuration](/platform/sso). Keep the default NeuralTrust callback allowed until sign-in through the custom hostname succeeds.

### Remove or roll back

1. Confirm that users can still reach and sign in through the default NeuralTrust URL.
2. Remove the custom hostname in NeuralTrust and wait for the application to confirm the change.
3. Remove its CNAME only after the hostname is no longer active.
4. Remove the custom callback from your identity provider after the default callback has been tested.

If activation fails, keep using the default URL, correct or restore the exact CNAME shown in NeuralTrust, and retry after its TTL expires.

## Runtime ingress hostnames

Hybrid runtime hostnames are generated from Helm `global.domain`. Configure the provider-specific `global.ingress` values for Kubernetes Ingress, or Route values for OpenShift, to control routing and TLS.

These settings cover TrustGate, TrustGuard, data-plane APIs, and other chart workloads. They do not change the browser-facing application hostname. See [Deployment configuration](/neuraltrust/deployment/configuration#ingress) and the relevant [provider guide](/neuraltrust/deployment/overview#provider-guides).

## Troubleshooting

* **Application DNS does not resolve:** Check the CNAME with `dig CNAME <hostname>`, confirm that it matches the target shown in NeuralTrust, remove conflicting records, and wait for the DNS TTL.
* **Application TLS remains pending:** Confirm that the CNAME resolves to the exact target shown in NeuralTrust.
* **Hostname is rejected:** Use a subdomain; apex and root domains are unsupported.
* **SSO redirects to the default URL or fails:** Confirm that the identity provider allows the exact custom callback URL shown in the SSO configuration.
* **Runtime hostname does not resolve:** Check `global.domain`, the rendered Ingress or Route hosts, and the corresponding public or private DNS records.
* **Runtime TLS fails:** Check the provider ingress or Route settings, certificate status, and TLS Secret or managed-certificate reference.