When creating a reverse proxy service you need to assign it a domain. EagleSafe ZTB provides built-in cluster domains automatically, and also supports custom domains where you bring your own domain name.
Built-in cluster domains
Every EagleSafe ZTB self-hosted deployment provides cluster domains in the format:
{subdomain}.{proxy-domain}For example: myapp.proxy.company.com, where myapp is your chosen subdomain and proxy.company.com is the domain configured on the proxy instance. These domains appear in the domain selector with a Cluster badge and receive automatic TLS certificates.
Built-in domains are dynamically derived from proxy instances currently connected to the management server. If a proxy instance disconnects, its associated domain may temporarily disappear from the selector until the instance reconnects.
Custom domains
Custom domains let you use your own domain name (e.g. app.company.com) for reverse proxy services. Before a custom domain can be used, you must verify ownership by creating a CNAME record in your DNS provider.
To manage custom domains, go to Reverse Proxy → Custom Domains.
Add a custom domain
- Go to Reverse Proxy → Custom Domains and click Add Domain.
- Enter your domain name (e.g.
proxy.company.com). - Select the target proxy cluster that will handle traffic for this domain.
- Click Save.
The domain will appear with a Pending Verification status. You must complete CNAME verification before the domain can be used with a service.
Verify a custom domain
Step 1 — Create the CNAME record
In your DNS provider, create a wildcard CNAME record pointing to your proxy cluster address:
| Record type | Name | Value |
|---|---|---|
CNAME | *.proxy.company.com | proxy.mycompany.com |
The exact target value is shown in the dashboard after you save the domain.
Step 2 — Verify in the dashboard
- Return to Reverse Proxy → Custom Domains.
- Click Verify Domain next to the domain.
- Confirm the CNAME details shown in the dialog match what you configured in your DNS provider.
- Click Start Verification.
Once verification succeeds, the domain status changes to Active and it becomes available in the domain selector. DNS propagation can take up to 24 hours — if verification fails, wait and retry.
Use a domain with a service
When creating or editing a reverse proxy service, enter a subdomain on the left of the selector and choose a base domain on the right. The full public URL is:
{subdomain}.{base-domain}For example, subdomain dashboard + base domain proxy.company.com → dashboard.proxy.company.com.
All domain types receive automatic TLS certificates.
Managing custom domains
- Re-verify: if a domain returns to Pending Verification after a DNS change, click Verify Domain to trigger a new lookup.
- Delete: removes the domain from your account. Built-in cluster domains cannot be deleted. Before deleting, ensure no active services are referencing the domain — they will stop routing traffic correctly.
Troubleshooting
Domain shows as Pending Verification
Confirm that the wildcard CNAME for *.{your-domain} is correctly configured and points to your proxy cluster address. Use a DNS lookup tool to check propagation:
dig CNAME *.proxy.company.comIf the record does not appear, check your DNS provider for typos or wait for propagation to complete.
CNAME pointing to the wrong cluster
The CNAME must resolve to one of your available proxy clusters. Check the expected target value on the Custom Domains page and update your DNS record accordingly.
