# Custom domains

> Point a Private Label customer's own domain at Road over Cloudflare custom hostnames, with automatic TLS.

Private Label customers can serve the Road dashboard from their own domain, so the product stays on their brand. Road runs this on **Cloudflare custom hostnames**, which route the traffic and manage the TLS certificate for the domain, including renewal.

> Custom domains are set up during Private Label onboarding. Road configures the hostname on its side; the customer's IT team adds the DNS records, in the same zone as the chosen domain.

## How it fits together

The customer picks a domain (say `charge.northwind.example`) and Road configures a Cloudflare custom hostname pointing at the Road origin. The customer then adds two kinds of DNS record in their own zone:

1. A **CNAME** from the custom domain to the Road origin. The console shows the exact target; it is one of Road's dashboard origins, normally:

   ```
   Type=CNAME   Name=charge.northwind.example   Value=dashboard.road.io
   ```

2. A **Domain Control Validation (DCV)** record, which proves control of the domain so Cloudflare can issue the certificate. The record is generated per domain and shown in the console; add it exactly as given. Its shape depends on the certificate:
   - a **TXT** record for a standard certificate, or
   - a **CNAME delegation** record (a target under `dcv.cloudflare.com`) for a wildcard certificate.

Once the records resolve, Cloudflare validates the domain, issues the certificate, and the domain serves over HTTPS. Renewal is automatic as long as the DCV record stays in place.

> **The DCV record's name and value are issued by Cloudflare for your specific domain and certificate type, so copy them from the console rather than from any example here. Leaving the record in place is what keeps renewal working.**

## Why DCV is required

Certificate authorities will only issue a certificate to someone who can prove they control the domain. The DCV record is that proof: it stops anyone else obtaining a certificate for a domain they do not own, and it lets Road automate issuance and renewal without further steps from the customer.