Customer Domains and DNS Records: Signed URLs for Secure Asset Delivery
Short answer: point a customer subdomain at your asset host with a CNAME, then keep authorization in signed URLs. DNS decides where a request goes; it never decides who may make it. For a logistics product, this distinction matters when a shipper wants labels, proof-of-delivery photos, or tracking assets to appear under assets.customer.example . The hostname can look customer-owned while the…
When delivering secure assets to customers, two key components come into play: customer domains and signed URLs. The process starts with the customer pointing their subdomain at the asset host using a CNAME record. The DNS system then determines where requests go, while the signed URLs ensure that only authorized users can access the assets.
In onboarding, there are two main flows. First, the customer is asked to publish a CNAME from their chosen subdomain to the asset host. Second, a signed URL is generated whenever an application grants access to an object. Although the browser sees the customer's hostname, the signed URL still contains the actual permission and expiry rules.
The vanity hostname is cosmetic and does not isolate one customer's objects from another's. Tenant-aware checks, such as object keys, bucket policy, and signing service, must still be in place before issuing a URL. Idempotency is crucial during onboarding, making the retry process more efficient. An upsert for the DNS record ensures that retries converge on the desired value without creating competing records.
Customer-owned zones give customers control over the public name and certificate workflow, while platform-owned zones provide tighter control over provisioning and incident response. Neither choice impacts signed URL semantics. The operational cost of customer-owned zones includes explaining DNS delegation, propagation, and record values, while platform-owned zones reduce coordination but may be rejected by customers who cannot manage branded asset URLs.
When choosing an implementation shape, consider factors like routing control, access control, and operational needs. Options include Cloudflare DNS + R2/Workers, Amazon CloudFront + S3, or Fastly + object storage. The main difference lies in who manages DNS and how signing is handled. Infrai offers a REST contract that covers both the DNS write and storage presign call, allowing small teams to add capabilities without needing another SDK.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
