# keenauth_custom_domain

The `keenauth_custom_domain` resource adds a custom login domain to the environment. See [Set up a custom login domain](/docs/guides/custom-domains) for what the domain serves and how verification works.

```terraform
resource "keenauth_custom_domain" "login" {
  hostname = "login.example.com"
}

output "dns_records" {
  value = keenauth_custom_domain.login.dns_records
}
```

## Lifecycle

- The domain starts in `pending_dns`. Publish the TXT and CNAME records in `dns_records` at your DNS provider; the platform verifies them and issues the certificate.
- `status`, `is_primary`, `failure_reason` and `certificate_expires_at` follow the platform's checks. They are read-only and never cause a plan change.
- Write `hostname` in lower case without a trailing dot. Write internationalized names as A-labels (`xn--…`).
- Changing `hostname` replaces the custom domain.
- Removing the resource releases the domain: sign-in on that domain stops and the name stays in quarantine for 30 days.
- The primary domain cannot be removed; the API answers `409 custom_domain_in_use`. Make another domain primary first, in the dashboard or with `keenauth custom-domains make-primary`.
- A domain released outside the provider is removed from state and planned again.
- The `development` environment has no custom domains.

## Import

Import by hostname or by ID:

```shell
tofu import keenauth_custom_domain.login login.example.com
tofu import keenauth_custom_domain.login cdom_01j9zq3v8c5m2x7k4t6r1n0b3d
```