Custom domain
Introduction
Section titled “Introduction”This guide helps you configure a custom domain (e.g., training.yourcompany.com) for your RansomLeak training platform. A custom domain gives your users a branded, professional experience with fully managed SSL — your employees log in and train at your URL, not ours.
With a custom domain configured, your organization gets:
- Branded access URL — users reach the platform at
https://training.yourcompany.com - Fully valid SSL — certificates are automatically provisioned and renewed by RansomLeak
- Branded outbound email (optional) — platform notifications sent from
notifications@training.yourcompany.com - No downtime — your default subdomain (
yourcompany.ransomleak.com) continues to work throughout setup and after activation
Prerequisites
Section titled “Prerequisites”Before you begin, ensure you have:
- A subdomain you control (e.g.,
training.yourcompany.com). Root domains are not supported — the custom domain must be a subdomain of a domain you own. - Access to your DNS management console (Cloudflare, Route 53, GoDaddy, Namecheap, etc.) with permission to create
CNAMErecords. - An active RansomLeak tenant. The custom domain attaches to an existing tenant; it does not create a new one.
Step 1: Request Custom Domain Setup
Section titled “Step 1: Request Custom Domain Setup”Contact RansomLeak support with the custom domain you’d like to use. Support will:
- Register the domain in our platform.
- Request an ACM SSL certificate for it.
- Send you the DNS records to add (step 2).
- Optionally set up email domain authentication with SendGrid, if you want outbound emails to come from the custom domain.
Note: If your tenant is configured to use custom SMTP (e.g., Office 365, your own mail server), email DNS records are not needed and will not be requested. Skip directly to the two required CNAMEs in step 2.
Step 2: Add DNS Records
Section titled “Step 2: Add DNS Records”Add the following CNAME records to the DNS zone for your root domain (e.g., yourcompany.com). Exact values are provided by RansomLeak support.
Required records
Section titled “Required records”Two records are always required:
| Record Type | Name/Host | Value/Target | Purpose |
|---|---|---|---|
| CNAME | <validation-name> (provided by us) |
<validation-value> (provided by us) |
SSL certificate validation |
| CNAME | training (your subdomain) |
<your-subdomain>.ransomleak.com |
Traffic routing |
Important: The traffic-routing CNAME must point to your tenant’s RansomLeak subdomain (e.g.,
acme.ransomleak.com), not toransomleak.com. The root domain hosts our marketing site; only the subdomain routes to the application.
EU-hosted tenants: if your platform address ends in
.eu.ransomleak.com, point the traffic-routing CNAME at<your-subdomain>.eu.ransomleak.cominstead (e.g.,acme.eu.ransomleak.com). The setup screen always shows the exact target for your tenant.
Optional records (branded email)
Section titled “Optional records (branded email)”If you’d like platform notifications sent from notifications@training.yourcompany.com, also add these three records:
| Record Type | Name/Host | Value/Target | Purpose |
|---|---|---|---|
| CNAME | s1._domainkey.training |
<dkim1-value> (provided by us) |
Email DKIM signing |
| CNAME | s2._domainkey.training |
<dkim2-value> (provided by us) |
Email DKIM signing |
| CNAME | em####.training (provided by us) |
<return-path-value> (provided by us) |
Email return path |
If you skip these, platform emails continue to be sent from @ransomleak.com (or from your custom SMTP server, if configured). The platform functions fully either way.
Example DNS configuration
Section titled “Example DNS configuration”Assuming your custom domain is training.acme.com and your RansomLeak tenant subdomain is acme:
| Type | Name | Value | TTL |
|---|---|---|---|
| CNAME | _abc123.training |
_xyz789.acm-validations.aws |
300 |
| CNAME | training |
acme.ransomleak.com |
300 |
| CNAME | s1._domainkey.training |
s1.domainkey.u1234.wl.sendgrid.net |
300 |
| CNAME | s2._domainkey.training |
s2.domainkey.u1234.wl.sendgrid.net |
300 |
| CNAME | em1234.training |
u1234.wl.sendgrid.net |
300 |
Use a short TTL (e.g., 300 seconds) while you’re making changes. You can raise it after everything is verified.
Step 3: Notify Us
Section titled “Step 3: Notify Us”Once the DNS records are in place, let RansomLeak support know. We’ll:
- Verify the SSL certificate validation record is resolving.
- Add your custom domain to our combined SSL certificate covering CloudFront and the load balancer.
- Activate the domain — your URL goes live.
You don’t need to do anything further. The certificate lifecycle (validation, renewal, expiry) is handled automatically.
Step 4: Access Your Platform
Section titled “Step 4: Access Your Platform”Once activated, your users can reach the training platform at your custom domain:
https://training.yourcompany.comYour default subdomain (yourcompany.ransomleak.com) continues to work — existing bookmarks, SCORM packages, and emails aren’t broken by the switch. You can migrate users gradually.
Expected Timeline
Section titled “Expected Timeline”| Step | Action | Expected time |
|---|---|---|
| 1 | RansomLeak configures the domain and issues the certificate | Immediate |
| 2 | You add DNS records | 5–10 minutes |
| 3 | DNS propagation | 5–60 minutes |
| 4 | SSL certificate validation (automated via ACM) | 5–30 minutes |
| 5 | RansomLeak activates the domain | Immediate |
| 6 | CloudFront propagation | Up to 15 minutes |
Total setup time is typically under one hour. DNS propagation can occasionally take up to 24 hours depending on your DNS provider.
Important Notes
Section titled “Important Notes”- SSL certificates are provisioned and renewed automatically by RansomLeak via AWS Certificate Manager. You do not need to purchase or install a certificate.
- Subdomains only. Root domains (e.g.,
yourcompany.com) are not supported — pick a subdomain liketraining.yourcompany.comorlearn.yourcompany.com. - No downtime. The default
yourcompany.ransomleak.comURL stays active throughout. There is no cutover window. - SCORM packages generated before activation continue to work and will use the custom domain for their API calls if they were generated after it was activated. Re-export SCORM packages if you want existing ones to point at the new domain.
- Emails. If you already use custom SMTP, the three email DNS records are not needed and will not be issued. If you use the default SendGrid transport, adding the email records makes outbound notifications come from your custom domain — otherwise they continue to come from
@ransomleak.com. - Single sign-on. If SAML SSO is already set up, it keeps its current Service Provider addresses (Entity ID and ACS URL) on
yourcompany.ransomleak.com, so sign-in keeps working. To move SSO to the custom domain, use Tenant Settings → SAML SSO — see Single sign-on (SAML).
Troubleshooting
Section titled “Troubleshooting”DNS records are not propagating
Section titled “DNS records are not propagating”Use a tool like dnschecker.org to verify your CNAME records are visible globally. Some DNS providers cache records aggressively, and changes can take time to appear worldwide. If a record still doesn’t resolve after 24 hours, double-check that you entered the correct name and value.
Certificate validation is taking too long
Section titled “Certificate validation is taking too long”The validation CNAME must match exactly what RansomLeak support provided, including any underscores or case-sensitive characters. Two common pitfalls:
- Some DNS providers automatically append your root domain to record names. If the record name in our instructions is
_abc123.training, your provider may require you to enter just_abc123.training(and it appends.yourcompany.comautomatically) or the full FQDN_abc123.training.yourcompany.com. Check your provider’s behavior. - CNAME values must not end with a trailing dot in most providers, though some require it. Follow your provider’s convention.
Users reach the marketing site instead of the app
Section titled “Users reach the marketing site instead of the app”The traffic-routing CNAME is pointed at ransomleak.com (the marketing site) instead of <your-subdomain>.ransomleak.com (the application). Update the record to point at your tenant subdomain. Your subdomain is the one you use today to access the admin portal (e.g., acme.ransomleak.com → use acme.ransomleak.com as the target).
Emails are still sent from @ransomleak.com after activation
Section titled “Emails are still sent from @ransomleak.com after activation”This is expected if you skipped the optional email DNS records or if your tenant uses custom SMTP. If you want emails from your custom domain, contact RansomLeak support to add SendGrid domain authentication — you’ll receive three additional DNS records to install.
The domain worked but now shows an SSL error
Section titled “The domain worked but now shows an SSL error”Certificates are auto-renewed, but if you see an SSL warning that persists, contact RansomLeak support. Do not attempt to issue your own certificate — our platform’s certificate model requires the domain to be on our combined certificate.
Security and Operations
Section titled “Security and Operations”- You retain DNS control. If you ever want to stop using the custom domain, simply remove the
CNAMErecords and notify RansomLeak support to remove the domain from our system. If SSO uses the custom domain, it moves back toyourcompany.ransomleak.comwhen the domain is removed: put the values from Tenant Settings → SAML SSO into your identity provider at the same time, or SSO sign-in fails. - Certificate renewals are automatic and require no action on your side as long as the validation
CNAMEremains in place. - No traffic is proxied through your infrastructure. Traffic flows: user’s browser → CloudFront → RansomLeak application. Your DNS only provides the name-to-CloudFront mapping.
- Wildcard subdomains are not supported. Each custom domain must be individually registered (you can have multiple — e.g.,
training.yourcompany.comandlearn.yourcompany.com— but not*.yourcompany.com).
Getting Help
Section titled “Getting Help”If you encounter issues not covered here:
- Verify DNS with an external tool (e.g.,
dig,nslookup, or dnschecker.org) before contacting support — this rules out DNS-side issues quickly. - Contact RansomLeak support at support@ransomleak.com. When reporting an issue, include:
- Your custom domain
- Your RansomLeak tenant subdomain
- The step where you got stuck
- Output of
dig <your-custom-domain> CNAME(or the equivalent on your platform) - Any error messages you see in the browser
Document Version: 2.0