Custom Portal URL - DNS Records

Hi ​@CoedyZurch .

I’ll write in general about using CNAMES and CAA records, that means, not specifically tied to Freshworks / FreshService:

You can certainly have CNAMES for the custom vanity URL, and at the same time you can have CAA records. They are indeed separate type of records.

The definition states that CAA follow CNAMES in terms of querying, not meaning that they will pull data from CNAMES.

In case you need a CNAME that points to X host and that host uses a cert from CA vendor Y, you need explicit permission in your CAA for that to work.

Hope this clarifies and makes sense.

Going now to the specific use case for FreshService: We currently have also setup a vanity/custom URL, for both, FreshService itself and Freshworks login for our instance, all on our own domain, so, CNAMEs are used for both URLs, and we have a single CAA record with the valid CA’s, for all of our domain certs: Let’s Encrypt for FW and other CA vendor for a wildcard we use.

Now, jumping to your particular use case, I may suggest to temporarily remove your CAA record; then, FW should be able to get your custom URL back; double check the CA used (ensuring it’s Let’s Encrypt) and create/enable in a new CAA record all your necessary CA’s for your domain.

Hope this helps.

Best,

Elvis

Hello Elvis,

Thanks for the information and responce. We added the CAA Records to the sub domain, but it doesn’t seem to be making a difference. Do you have your CAA Record for LetsEncrypt on your subdomain or on the parent domain?

From my understanding, the RTC Standards state you should not have a CAA Record on the same domain where a CNAME Record exist. If you do, the CNAME should be recognized or used. It seems that is not followed by the entire Industry though. This newer FS Articles says to add the CAA Records to the sub domain, which would go against this practice. This older FS Article does not mentioned a CAA Record. A bit confusing on where to troubleshoot and support keeps sending us in circles.   

FreshWorks used Google for our last 90 day cert, which is the one that didn’t renew. All certs before that were going through Lets Encrypt. I am not sure if there is a relation, but just an observation. 

Hi.

I forgot to mention that; I had it on the parent domain, not at subdomain.

.

The definition states that CAA records can be setup for domain and/or subdomains. Subdomains inherit CAA value/permissions from main domain, but it can be overridden. This means that if you are setting up a CAA record at subdomain (for an override), a CAA record must exist for your main/parent domain.

Regards,

Elvis