Is it worth doing
It is genuinely optional. A BusinessOps subdomain works identically and is one less thing to maintain. Use your own domain if:
- You want staff trained to trust only addresses ending in your own domain, which is a real defence against phishing.
- Clients or auditors will see the address.
- You want the option of moving the service later without retraining anybody.
Either way it is the same vault, same price, same security. The certificate is issued and renewed automatically for whichever address you use.
What you need first
- Access to your DNS records. Usually at the company your domain is registered with, or wherever your website is hosted. If your web person handles this, forward them this page.
- A name that is not already in use.
vault.yourcompany.com.auorpasswords.yourcompany.com.auare good choices. Do not use your bare domain, since that is where your website lives. - Your two record values from us. The verification value is unique to your subscription and your domain, so it is issued per order. If you chose your own domain at checkout and do not have your records yet, email hello@businessops.com.au with the domain you want and we will send both records back.
Type it in and the examples below will show your own domain instead of ours.
https://vault.yourcompany.com.au Showing an example address. Enter the domain you want to use and these records will show it.
The two records
The first proves the domain is yours. The second sends traffic to your vault. Both have to be in place before anything happens, and the order does not matter.
Record 1: proof of control
| Field | Value |
|---|---|
| Type | TXT |
| Name or host | _bo-vault-challenge.vault.yourcompany.com.au |
| Value | bo-vault-verify= followed by the unique value we send you |
| TTL | 300 seconds, or the lowest your provider allows |
Without this record we will not publish a route for your domain or ask for a certificate in your name. That protects you from anyone else claiming your address, including by mistake.
Record 2: point the name at your vault
| Field | Value |
|---|---|
| Type | CNAME, or A if your provider will not let you use a CNAME here |
| Name or host | vault.yourcompany.com.au |
| Value | The target we send you, which is our server |
| TTL | 300 seconds while you are setting up |
Publishing them
Sign in wherever your DNS is managed
Your registrar, your web host, or a service like Cloudflare. If you are not sure which, whoever set up your website email addresses will know.
Add the TXT record exactly as given
Copy and paste the value. One transposed character and it will not verify, and the failure looks identical to having done nothing.
Add the CNAME or A record
Save, and leave it alone
DNS changes take anywhere from a minute to a few hours to spread. There is nothing to click on our side.
What happens next
Automatically, without anybody at either end doing anything:
- We check your DNS every 10 minutes. When both records are visible, your vault is published at your address.
- A certificate is issued for your domain in the same pass, so the padlock works from the first visit.
- You have 3 days. If the records have not appeared by then, the request is closed off and we get in touch. Nothing is lost, we just start it again rather than leaving it hanging.
If the wait is bothering you, check the records yourself. Search for a free DNS lookup tool, ask it for the TXT record on your proof-of-control name, and see whether the value you pasted comes back. If it does not, the change has not published yet or it went into the wrong place.
The four mistakes people make
Typing the full name when the provider adds the domain for you
Many DNS panels append your domain automatically. If yours does, entering the whole thing gives you
_bo-vault-challenge.vault.yourcompany.com.au.yourcompany.com.au, which verifies nothing. Check what the panel shows after saving and trim it if you see your domain twice.Leaving Cloudflare proxying switched on
If your DNS is on Cloudflare, the record must be DNS only, the grey cloud, not the orange one. Proxying hides where the name really points, so our check never passes and your vault never activates.
Reusing a name that already serves something
If
vault.yourcompany.com.aualready has a record on it, the old one has to go. Two conflicting records is a coin toss, and the outage will not look like a DNS problem.Deleting the TXT record afterwards
Leave it in place. It costs nothing, and it is what lets us renew and re-verify without asking you to do this again.
Once it is live
- Tell your team the new address and have them update the server setting in their apps. It is the same Self-hosted field they used at setup, see install the apps.
- Put the TTL back up to an hour or so, now that you are not changing anything.
- Add it to your domain renewal notes. If the domain lapses, your vault address goes with it. That is worth writing on the same page as the registrar login.
Already running on a BusinessOps subdomain and want to move? That is a change we make at our end as well as yours, so talk to us first rather than pointing DNS at us and hoping. Nothing is lost either way, but there is a right order to do it in.
Need your records, or stuck on DNS?
Email hello@businessops.com.au with the domain you want to use. We will send both records ready to paste, and we are happy to talk your web person through it.