Custom portal domains

A workspace can publish one composed portal at its verified white-label custom domain, for example:

https://portal.yourcompany.com/
https://portal.yourcompany.com/projects/...
https://portal.yourcompany.com/finance/...

The custom hostname and branding remain managed by Workestra white-label settings. Portals stores only which published portal should open there. This keeps the domain configuration in one source of truth.

Before you start

The workspace needs access to white-label configuration.
The portal must be published.
You need permission to manage the domain’s DNS records.
The hostname must be attached to the Workestra hosting project. Workestra operations or your account manager provides the required CNAME target.

Configure the domain

Open Settings → Administration → White label → Domain.
Enter a subdomain such as portal.yourcompany.com.
Save the domain to generate its unique ownership-verification record.
Select Copy developer instructions to copy a ready-to-send DNS handoff.
Send that message to the person who manages your website or DNS.
Have them add the supplied CNAME record and the Workestra TXT record.
Select Verify now after DNS has propagated.
Open Portals → Settings.
Under Custom portal domain, choose the published portal that should open at that hostname.
Save the portal defaults and open the domain.

Once the domain is attached and DNS is valid, the hosting platform provisions managed HTTPS. DNS propagation and certificate issuance can take time.

Send the setup to your developer

The Domain screen generates a localized, ready-to-send message containing:

the complete portal hostname;
the CNAME record name;
where to use the CNAME target supplied by Workestra;
the exact TXT record name and unique verification value;
a reminder to create DNS records rather than URL forwarding; and
the confirmation you need before selecting Verify now.

The records intentionally use different names:

CNAME  portal.yourcompany.com
TXT    _workestra.portal.yourcompany.com

A CNAME hostname cannot also contain a TXT record. Keeping the ownership record at _workestra.<portal-hostname> makes the DNS configuration valid and lets Workestra verify ownership without conflicting with portal routing.

Invitations and clean URLs

When the selected portal is published and the domain is verified:

New invitation and resend emails use the custom origin.
The portal opens at /, without exposing the internal portal slug route.
Module navigation uses clean paths such as /projects/..., /finance/..., and /support/....
Existing portal branding, logo, colors, and powered-by preference continue to apply.

Security

A custom domain does not make the portal public. The supported access policy remains invitation-only. Workestra still checks the portal session, exact membership, member status, role, section, source policy, module entitlement, and shared record on the server.

Pausing or archiving the selected portal makes it unavailable on the custom domain. Selecting a different portal requires that destination to be published and belong to the same workspace.