> ## Documentation Index
> Fetch the complete documentation index at: https://docs-staging-quickstart-revamp.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> Learn how to troubleshoot issues with custom domains.

# Troubleshoot Custom Domains

See the following video on common issues with <Tooltip tip="Custom Domain: Third-party domain with a specialized, or vanity, name." cta="View Glossary" href="/docs/glossary?term=custom+domains">custom domains</Tooltip> and refer to the sections below for troubleshooting steps for specific scenarios.

<iframe width="100%" height="316" src="https://www.youtube.com/embed/f6fkOkS1RFA" title="Custom Domain Issues" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen />

## Custom domain is still pending verification

It can take up to 48 hours for the DNS to be propagated.

* If you continue to see this error in the Dashboard, ensure that the CNAME record is properly configured in your domain management service. You can confirm the configuration of your CNAME record using:

  * A tool like [Mxtoolbox](https://mxtoolbox.com/DNSLookup.aspx) or [Google](https://dns.google.com)
  * The `dig` command in your terminal
* Ensure that the domain name is not already associated with an A record.
* Ensure that no errors were made when typing or copying the CNAME record's domain name or value.

If you have ensured the above and the custom domain is still pending verification, wait 4 hours before reverifying your domain. To avoid any interruptions to your service, do not recreate the custom domain when reverifying.

## Cloudflare CNAME flattening

<Callout icon="file-lines" color="#0EA5E9" iconType="regular">
  Auth0 recommends turning off CNAME flattening unless it's strictly necessary, according to the Cloudflare documentation, [Understand and configure CNAME flattening](https://support.cloudflare.com/hc/en-us/articles/200169056-Understand-and-configure-CNAME-Flattening). CNAME flattening for Auth0 managed certificates is an unsupported configuration and as such may cause the custom domain to break without notice if CNAME flattening is enabled.
</Callout>

CNAME flattening affects the Auth0 verification and certificate renewal processes due to the way it handles DNS records. Enabling CNAME flattening in Cloudfare after setting up a custom domain does **not** prevent certificate renewal.

If you need to enable CNAME flattening for all subdomains managed by Cloudfare and also configure a specific subdomain to be an Auth0 custom domain, consider delegating the subdomain for Auth0 to another DNS provider. To learn more, read [Delegating Subdomains Outside of Cloudflare](https://support.cloudflare.com/hc/en-us/articles/360021357131-Delegating-Subdomains-Outside-of-Cloudflare) in the Cloudflare documentation. This will enable you to use CNAME flattening for all subdomains except the one used for Auth0.

## "You should not be hitting this endpoint"

If you see this error when configuring a custom domain, you must perform additional configurations, which varies depending on your setup. To learn more, see [Configure Features to Use Custom Domains](/docs/customize/custom-domains/configure-features-to-use-custom-domains).

## "Service not found"

If your application issues an `/authorize` request with `audience=https://login.northwind.com/userinfo`, the server will return a `Service not found: https://login.northwind.com/userinfo` error. This is because even if you set a custom domain the API identifier for the `/userinfo` endpoint remains `https://{yourOriginalAuth0Domain}/userinfo`.

Similarly, using your custom domain in calls to the [Auth0 Management API](https://auth0.com/docs/api/management/v2) will error for the same reason.

To fix this your app should instead use `audience=https://{yourOriginalAuth0Domain}/userinfo`. You can also remove this `audience=[...]/userinfo` parameter altogether if your application is flagged as **OIDC-Conformant** in the **OAuth2** tab of the application's **Advanced Settings**.

## Errors related to Internet Explorer

If you are using Internet Explorer, you may see any of the following error messages:

* "No verifier returned from client"
* "Origin header required"
* "Failed cross origin authentication"

When both the Auth0 domain and the app domain are in the same trusted or local intranet zone, Internet Explorer does not treat the request as a cross-domain request and therefore does not send the cross-origins header.

If you see any of these errors and you are using Embedded Login, you can move one of the sites out of the trusted or local intranet zone. To do this:

1. Go to **Internet Options > Security**.
2. Select the **Local Intranet Zone** tab and go to Sites > Advanced. Add your domain.
3. Return to the **Security** tab, and make sure the proper zone has been selected.
4. Click **Custom Level** and look for **Access data sources across domains** under the **Miscellaneous** section. Check the radio button next to **Enable**.

Alternatively, you can remove reliance on cross-origin authentication by implementing [Auth0 Universal Login](/docs/authenticate/login/auth0-universal-login).

## Learn more

* [Configure Features to Use Custom Domains](/docs/customize/custom-domains/configure-features-to-use-custom-domains)
* [Configure Custom Domains with Auth0-Managed Certificates](/docs/customize/custom-domains/auth0-managed-certificates)
* [Configure Custom Domains with Self-Managed Certificates](/docs/customize/custom-domains/self-managed-certificates)
* [TLS (SSL) Versions and Ciphers](/docs/customize/custom-domains/self-managed-certificates/tls-ssl)