Domain guide
Custom Domains and SSL
Use your main domain or a subdomain for a SoundSync storefront with managed SSL.
Your main domain is supported
Use an apex domain such as example.com or a subdomain such as shop.example.com. A store/shop prefix is not required. You need control of the domain and access to its DNS records; SoundSync provides the hosted storefront connection and SSL certificate management.
Moving an apex domain can affect an existing website. Review current DNS records and preserve unrelated mail records. Domain ownership and DNS access do not authorize SoundSync to change unrelated services.
SoundSync
Connect the domain
-
Enter the hostname
Choose the apex or subdomain you actually want to publish.
-
Review provider guidance
The setup view detects available provider/nameserver information and presents the required records.
-
Add the exact records
Use the displayed targets and ownership-verification values in your DNS provider. Avoid publishing verification tokens in screenshots.
-
Verify ownership and routing
Check the step-by-step status until DNS and ownership requirements are met.
-
Wait for SSL readiness
The certificate and connection status determine readiness; DNS propagation has no universal completion time.
-
Check real pages
Visit home, catalog, product, cart, checkout entry, support, and customer sign-in on the intended host.
Related settings are not automatic
Storefront SSL does not verify an email sending domain. Optional GA4 tracking becomes ready on the verified custom host only when configured separately.
If verification fails, compare record name, record type, target, and proxy/provider guidance. Do not repeatedly replace unrelated DNS records or assume an SSL warning is safe to bypass.
SoundSync
Brand defaults and page overrides
Read each domain setup area separately
The guided setup reports Website / Storefront, Email, Tracking and Verification separately. Tracking here means branded email-link tracking DNS, not optional Google Analytics. Required DNS records must be verified, but overall readiness also needs provider activation, active storefront SSL, secure email-link tracking and a completed sender identity. Four green DNS areas alone do not prove the whole setup is ready.
A required record with an error needs attention. Pending records keep setup in progress; an optional skipped record is not a required verification. The guide returns to the next incomplete required step instead of treating a saved Review step as proof everything is connected. Refresh status when no confirmed next step is shown.
Website DNS, SSL and email are different checks
A working storefront hostname does not prove email authentication, branded tracking or ownership verification is complete. Check the Website / Storefront area and the storefront DNS and SSL status for customer traffic, then review each remaining area for its own purpose. A DNS match does not mean an SSL certificate is already active.
Use the exact hostname and records returned for your apex domain or selected subdomain. SoundSync handles supported hosting and SSL provisioning; you need control of the domain and DNS. Existing DNS, propagation and certificate readiness can affect the connection. Neither a successful save nor an HTTP 200 promises a propagation deadline.
SoundSync
From your domain to a ready connection
-
Choose the hostname
Enter the root domain and choose @ for the main domain or the supported subdomain you want. Keep unrelated website and mail records safe.
-
Let SoundSync prepare the providers
The interface registers the storefront and sending domain and retrieves their exact routing, DKIM, return-path, tracking and ownership records. Preparing your exact DNS records is not a request for your registrar password.
-
Copy the displayed records
Add the available records while SoundSync retrieves any remaining provider records. Only missing values stay unavailable for copying. Use the exact host and value shown; do not invent a target or replace your existing inbox MX records with the sending return-path records.
-
Check DNS and hosting
Follow the current required step. Hosting verification runs while the page is open; DNS matching and SSL issuance can finish at different times.
-
Finish branded sending and tracking
Transactional and marketing verification are separate. Secure email-link tracking also needs its own certificate; a storefront certificate does not activate it.
-
Save the sender identity
Set the support address and the licensing, notification and marketing sender local parts. Use the combined readiness result, not a saved Review step, before announcing completion.
SoundSync
When setup needs another step
| What you see | What to do |
|---|---|
| Preparing your exact DNS records | Add any available records now. Review the missing-record list and use Retry provider setup or Refresh remaining records if preparation needs another attempt. Missing provider records are not fixed by adding a guessed DNS value. |
| Connect and verify your storefront host | Use Retry hosting verification and review the displayed error. The hostname must be registered with hosting and show active DNS and SSL. |
| Waiting for email provider verification | SoundSync polls the existing provider checks after DNS passes instead of restarting verification. Use Check provider status or View provider status to see whether transactional email, marketing or the tracking SSL certificate is pending. Keep the verified DNS records in place; sender addresses do not need separate DNS records. Use View DNS setup instructions only when DNS records are still missing. A tracking certificate can take additional time after DNS verifies. |
| Finish your email sender identity | Save the support address and the three sender purposes for the selected domain. Verified providers alone do not complete this identity step. |
| Waiting for tracking SSL activation | Sending providers can be verified while the tracking certificate is still pending. Keep the tracking DNS record in place and check provider status; do not replace verified email records. When providers are pending, the interface can show View provider status and wait times. These are estimates, not guaranteed completion deadlines. |
| Provider setup still fails | Check the displayed provider error and contact SoundSync with the domain and safe error details. Do not share provider credentials or private verification values in a public report. |
SoundSync
Protect existing email DNS
| Record or copy instruction | Safe setup |
|---|---|
| SPF: one policy per hostname | Keep one v=spf1 TXT policy at each exact hostname. Merge the required include mechanisms before the final ~all or -all; do not paste a second complete policy or duplicate the version/all terms. Review the proposed replacement and previous value before saving. |
| DMARC: preserve your policy | Keep a valid existing DMARC record, including its policy and reporting addresses. Do not create a second record or overwrite it with a generic example. Correct an invalid or conflicting policy before continuing. |
| Copy plan: create / replace / preserve / blocked | Create adds a missing record. Replace proposes the combined value for an existing record. Preserve means keep the existing policy. Blocked means resolve the displayed conflict before copying; do not overwrite DNS blindly. A missing provider value is also unavailable for copying. |
| MX: priority and exchange | Enter the displayed numeric priority separately from the mail-server exchange. A sending return-path MX belongs at its exact return-path host, not at the root inbox hostname. Keep existing inbox delivery records. |
| DKIM and DNS hostnames | Use the exact current provider record type, host and value. DKIM may use TXT, not necessarily CNAME. A DNS console may expect a relative host or a full hostname; avoid adding your domain twice. Never guess a provider target from a screenshot. |
SoundSync
Copy the exact DNS records
Actual current SoundSync domain interface, captured locally with example.com and sanitized sample records. This illustrates the workflow, not a live customer-domain verification.
SoundSync
Finish provider and secure tracking verification
Actual current SoundSync domain interface, captured locally with example.com and sanitized sample records. This illustrates the workflow, not a live customer-domain verification.
Sending readiness is specific to the email purpose
Use transactionalSendingUsable and transactionalBlockingReasons for receipts/licensing notices; use marketingSendingUsable and marketingBlockingReasons for campaigns and Growth Flows. Legacy combined blockingReasons can include the other provider. A transactional-provider problem alone does not prove verified marketing sending is blocked.
marketingTrackingUsable is separate from sending. If tracking TLS is not ready, the service sets trackClicks:false and trackOpens:false. Marketing can proceed without that tracking only when the configured provider supports explicitly disabling it; otherwise sending remains blocked. A local checkbox cannot bypass provider TLS checks. This guide does not enable or change provider configuration.
Full Brand Domain readiness still requires complete DNS, website SSL, email/tracking and identity checks. A usable single sending purpose is not completion of the whole wizard. A tracking certificate must be trusted and unexpired; missing certificate status is not readiness. Email tracking is separate from GA4.
A provider lookup failure is not a missing DNS record
Read customDomain.providerReadErrors.resend and .elastic with providerVerification, lastError and lastCheckedAt. A timeout or mismatched provider domain is a lookup problem, not proof that existing DNS must be replaced. Retained prior observations are not a new verification result.
Provider reads are bounded and cached. The read helper uses GET without creating domains, starting verification or persisting provider results. Surrounding settings reads can initialize sender profiles, so the endpoint is not a zero-write health probe. Explicit prepare/refresh operations are separate writes. Keep credentials private and retry the intended status read before resetting a working domain.
SoundSync
Domain wizard permissions
| Operation | Required workspace access |
|---|---|
| Read wizard state or events | domains.view and all-products scope. Domain configuration belongs to the workspace, not one assigned product. |
| Start, prepare, provider connection, record checking, identity/sender saves, progression or reset | domains.view + domains.manage and all-products scope. A selected-product role cannot write workspace-wide DNS configuration. |
| 403 developer_team_permission_denied / developer_team_all_products_scope_required | Ask the workspace owner for the appropriate existing access. Retrying with another product ID does not change workspace scope. |