| docs

Appearance

Domain Security ​

Domain Security holds the policies that apply when accounts add domains to this server, and the queue of domain adds that were rejected because they would overlap another owner's namespace.

Overview ​

URL: /admin/settings/domain-security-settings

The page sits under Settings > Security. The navigation badge carries the number of requests waiting for a decision.

The Domain Security policies with the pending overlap queue

The namespace check ​

A domain being added is checked against the whole platform's namespace, not just against exact matches. An add is blocked when the name matches, is a subdomain of, or is a parent of a domain another owner already holds. This is what stops two accounts ending up serving overlapping names.

An account's own subdomains are unaffected. Adding shop.example.com to the account that already holds example.com is ordinary use, not an overlap.

This check is always on. It is not a policy you can turn off; what you decide here is what happens to the rejections.

Ownership verification ​

Require ownership verification for new domains adds a second rule on top: a domain that is new to this platform can only be added after the account publishes a DNS TXT record proving it controls the name.

The add form shows the exact record to create, and verification runs again automatically when the account retries. Subdomains of a domain the account already holds are exempt, so the rule applies to the first claim on a name rather than to every add.

Turn this on where accounts are self-service and you cannot vouch for who is adding what.

Pending overlap requests ​

Every blocked add is recorded here with the domain and the account that tried. You have two answers:

  • Approve - the account can add the domain on its next attempt.
  • Dismiss - the rejection stands.

Approving is a deliberate act. It means you have decided these two owners may hold overlapping names, so approve when you know the relationship and dismiss when you do not.

Approved overlaps ​

The pairs you have allowed to coexist. Removing an approval blocks future adds and cluster syncs for that pair again; it does not remove a domain that has already been added on the strength of it.

DNS clusters ​

A DNS cluster zone that overlaps an earlier claim by another owner is flagged rather than served, so the check is not something an account can walk around by bringing the name in through a cluster. Open the fleet-wide DNS zones and conflicts view takes you to the fleet-wide picture.

Upgrades ​

Overlaps that already existed on the server, and overlaps arriving with a migration, are carried over as approved. Nothing that was resolving before an upgrade stops resolving because of it.