Skip to content

Domains and addresses

Your organisation can open OS at a web address of its own, such as ai.jansen.com, and appear in its own brand identity straight away, the sign-in page included. This page shows how to prove a domain, add an address, which DNS records to publish and what each status means. You find the screen under Organization management, Domains and addresses.

Who may do what

An org-admin of the organisation can prove domains and add, retry and remove addresses (Manage roles). Someone who may only look sees the domains and addresses without buttons. A button shows only when OS would also allow the request behind it.

Proving a domain

Every address lies under a domain your organisation has proved is its own.

  1. Under Proved domains, enter the domain, for example jansen.com, and choose Add.
  2. The screen shows a TXT record: a name and a value. Copy them and publish the record at your domain's DNS provider.
  3. Choose Check. If the record cannot be seen yet, OS says so. DNS can take up to a day; try again later.

A domain your organisation already proved for company login does not need proving again. If you choose Give up domain, the addresses under that domain stop working.

What a proved domain steers

A proved domain can also decide how people sign in. When it belongs to your organisation's company login, the sign-in page sends everyone who enters an address in that domain, such as anne@jansen.com, to your own identity provider. A domain another organisation already uses for its login cannot steer a second one.

If you give the domain up, the company login it steers goes with it: members keep their accounts but no longer sign in through your provider.

Your default address

Every organisation has a default address: its label under a domain of an organisation above it, such as northwind.os.artific.nl. You choose the label yourself: 3 to 40 lowercase letters, digits and hyphens. A label that is taken or that OS keeps for itself (such as www or login) is refused at the field. The default address can be switched off by the administrator of the organisation that holds the domain.

Adding an own address

Under Own addresses, enter the address, for example ai.jansen.com, and choose Add. The address must lie under a proved domain. The domain itself (jansen.com) cannot be an address; put www or ai in front of it. An organisation has at most five own addresses.

Then you publish one record: a CNAME from your address to edge.os.artific.nl. OS then requests a certificate by itself.

A domain for sub-organisations

A partner, or an organisation with departments, can give a proved domain to every organisation below it. Each organisation below then gets an address such as northwind.jansen.com without doing anything itself. Choose the domain under Domains for sub-organisations and choose Add. An organisation has at most three.

You publish two records: a CNAME from *.jansen.com to edge.os.artific.nl and a CNAME from _acme-challenge.jansen.com to the value the screen shows.

The records and their status

The screen shows the records of each address in order, each one done or to do, and names the first record still to do with what to change:

  • Publish this record: OS does not see it yet.
  • The record is published but not visible yet: wait; DNS can take up to a day.
  • Let's Encrypt could not validate: check that the CNAME points to the value shown.

The * record of a domain for sub-organisations is checked once the certificate is issued. Your own browser does the check: it asks for a random name under the * and sees whether OS answers. If it cannot, the record is named as the next step: wait for DNS to update, check that the * points to edge.os.artific.nl, and choose Check again.

The address itself has a status:

Status Meaning
Waiting for the records OS waits until the records can be seen.
Certificate being requested Let's Encrypt checks the records and issues the certificate.
Active The address works.
Failed The certificate did not come. Fix the record and choose Try again.
Inactive The domain's proof is gone; the address no longer works.

Setting up automatically with Entri

Where OS offers it, Set up automatically sits above the records. With it Entri, a service outside OS, writes the records at your DNS provider for you: you sign in at your provider and Entri writes the records. Entri sees your domain, the records, your IP address and your sign-in at the provider. Entri's window is in English, French or Spanish.

It is a help, not a proof: after Entri too, OS reads for itself whether the records are in place. If setting up automatically does not work, or you would rather not use it, copy the records yourself.

Every change goes into the audit trail.