Unraveling IP-based host mapping for Zendesk Support Follow

When you first start your Zendesk Support subscription, the URL for your Zendesk Support web portal is some variation on mycompany.zendesk.com. Since all companies take great stock in managing their brand, Zendesk Support offers you a feature on our Team, Professional, and Enterprise plans called host-mapping that allows you to show your own branded URL to all customers.

You can choose IP-based or SNI-based host mapping. SNI-based host-mapping is supported in the Team, Professional, and Enterprise plans, while IP-based host mapping is only supported in the Professional and Enterprise plans. For more information, Setting up host mapping in the Zendesk Administrator's guide.

This article covers IP-based host mapping.

Modify Your CNAME Record

To get this working, you’ll need to make a few changes to your subdomain’s DNS . When dealing with DNS changes like CNAME records, Time To Live ( TTL ), and Secure Socket Layer ( SSL ) certificates, things can get complicated. Here’s a walk-through that should make this easier to understand.

Assuming you already have your desired subdomain ready to go (ie. support.mondocameras.com), you’ll need to make a DNS change. This is done through the host where your domain resides. The change you will be making is to the CNAME record.

As shown above, point the CNAME record for your subdomain (shown in the “Host Record” field in this example) to your subdomain, as shown in the “Points to” field. The end result should look like the following:

Once this has been done, allow some time for DNS propagation. DNS changes typically take anywhere from a few hours to a day – depending on your Time To Live (TTL) settings – to reflect the changes. In the meantime, you may see some redirects. TTL can be altered at the host level if you have access to this.

Enable Host Mapping

Next, log in to your Zendesk. Go to Settings > Account > Branding , and under the Host mapping field, add your custom subdomain; ie. support.mondocameras.com. This enables the host-mapping to occur.

If you don’t do this, your subdomain will point to an error page, rather than your page.

Host Mapping and SSL

Keep in mind when host-mapping your subdomain, Zendesk provides a free SSL certificate for all *.zendesk.com domains. Now that you’re using your own subdomain, our SSL certificate will no longer apply, and you may experience a certificate error. Or rather than seeing your subdomain map, your customers will be redirected from your support.mycompany.com URL to the mycompany.zendesk.com URL.

Use Hosted SSL in order to enable HTTPS (encrypted communication) for your custom subdomain.

  1. Go into your Zendesk Support under Settings > Security > SSL . Below Hosted SSL , you'll see a Generate a request button. Clicking this link will download a certificate signing request file (CSR) to your computer.
  2. Provide the CSR to an SSL Certificate Authority, who will then generate a certificate for your custom subdomain (ie. support.mondocameras.com) and provide you with a certificate bundle. See Preparing a SSL certificate to upload . Before paying for the certificate, make sure the certificate authority supports SHA-2 encryption. The CSR uses SHA-2 encryption.
  3. After obtaining or preparing the SSL certificate, return to theer Settings > Security > SSL page and click I have a certificate , then Upload certificate .
  4. Next, simply upload the certificate. The installation process on our end takes up to five business days, at which point our wonderful Ops team will reach out to you with next steps. You will be given instructions to make an additional CNAME record change for your subdomain, to a new CNAME record URL reference which is created when your SSL certificate is installed.  (ie. support.mondocameras.com to mondocam.ssl.zendesk.com).

If you're a Team plan customer, IP-based hosted SSL is not supported, but you can use SNI-based hosted SSL instead. For more information, Setting up host mapping in the Zendesk Administrator's guide.

Hope this helps you customize your Zendesk URL and continue providing your users with great support, branded to match your company! If you have any additional questions, you can contact our customer service team at support@zendesk.com

Have more questions? Submit a request


  • 0

    Is there a time limit to do the upload? My app is not ready to production but i have already generated the csr and obtained the certificate.


  • 0

    Hi there Alexandre, 

    The ability to download the certificate request after it is generated expires after 5 days. However, if you have already downloaded it and obtained your certificate bundle, you should be able to upload it at any time when you are ready. So long as you do not generate another certificate request. :) 

    If you encounter any issues, feel free to write in to us at support@zendesk.com

  • 0

    What format do you need the SSL response returned as?  I have tried saving the response as a .txt as well as a .crt and keep getting the error message of "The uploaded certificate is badly formatted".  Thanks!

  • 0


    The actual certificate must be a .crt file type.

    When you upload the certificate bundle to Zendesk for install, it should be contained within a compression file formatted folder, (ie. certificate.zip). If you have changed the file type from .crt to .txt of the actual certificate, depending on how you did this you might have a corrupted file. You should be able to get the .crt from your certificate authority if you believe you have corrupted it and attempt the upload again. 

    If you continue to experience this error Neil, please write in to us at support@zendesk.com so we can assist you further. 

  • 0


    We uploaded our SSL certificate to use hosted SSL, any chance we can get it approved faster than the  upto 5 business days.

    Many thanks

  • 0

    Hey Sean: 

    Fire a ticket to support@zendesk.com and we'll see what we can do. 

  • 0

    Just been through this guide and found that uploading via the interface fails when using a .zip file of the .crt certificate.

    The only way it worked was to actually upload the .crt file via the admin portal. This contradicts the above notes to use .zip and caused confusion.

    Also it might be best to highlight the format you require as well. We found only X509 cert was valid, and this cert was not allowed to include the intermediate or root certs in the file either. 

    We use Thawte as our our provider who give you several options to copy the certs from their admin interface. X509 with all 3 certs, and PKCS7 format, even using your CSR file to request the cert.

    Knowing which options to use would ensure the file we grab from our provider is compatible with what your systems would expect. This would be helpful to note or elaborate on in the guides. Unless of course this is a bug in the .crt check performed on the upload process via your admin portal?

  • 0

    Hey Darren: 

    Thanks for your post! I'm going to forward your comments on to the right folks. Something seems a bit off. 

  • 0

    We've done this and our web portal is updated for the customers to be using our http://help.paloalto.com subdomain.

    However, I have 2 points of confusion:

    • my agents are still being redirected back to our *.zendesk.com address when they're logging in to work on tickets. 
    • And, when we use the sidebar search to get links to topics to answer tickets, we get links to the *.zendesk.com urls instead of the custom domain as well. 

    Is that working as intended or did we get something wrong in the setup?

  • 0

    Hi : 

    We uploaded our SSL certificate to use hosted SSL ( support-splashtopbusiness.splashtop.com).

    And  I checked the Regular SSL setting .  but my web SSL always show the SSL fail . 

    Please you can help me ? 


  • 0

    Hi Calos, 

    I checked your settings and there are adjustments we should make to get this error to go away. I'll follow up with you in a ticket in just a few minutes!

  • 0


    • The new Zendesk interface (only visible to agents) does not maintain the host mapping, that's correct. Customers will see the correct name but the agent side won't change. 

    • It's true that if you search your forms using the Search on the left you'll get links with "zendesk" in them. When I tested it though, opening a new window (even while logged in as an agent in the other window) worked - I was able to keep the host mapped name and access the correct links. 

    I used Chrome - hopefully that's the same for all browsers.

  • 0

    Hey Techies; I need to know if I can make a rollback if my host mapping goes wrong, I'm already into production and I can't take my service down. 

  • 0

    Hey Jorge,

    Sure, you can remove your hostmapping at any time and your Zendesk account will default back to your old subdomain.zendesk.com url address. If you have external links to the branded domain you will need to change them, but no essential functionality should break with a host mapping change.

  • 0

    Hi Support,

    We've done the host mapping and change the CNAME record for customer to be using our http://help.nexusguard.com subdomain.

    However, i can reach the page but the URL still showing zendesk's URL. Is there anyway to change it to show our subdomain only?


  • 0

    Hi Brian!

    I see that we're working with you in a ticket on this as well. In order for your custom domain to always display, you have to enable hosted SSL and upload an SSL certificate that we can put on our servers.

    If you don't have a hosted SSL certificate, you will automatically be redirected to Zendesk's secure domain, for your safety. You can find out more information about SSL here: Providing secure communications with SSL.

    Hope that helps!

  • 0

    Hi there,

    I'd like to set up a domain based entirely on Zendesk. I.e. not a support sub-domain, but the whole website hosted as a Zendesk site.

    I don't believe it's acceptable to have just a CNAME in the DNS records - you must have an A record, too. Is there a recommended IP address to use to map the domain, and will this work?

  • 0

    Hi Paul!

    Just to clarify, are you asking if you can host your entire website on Zendesk's servers? We don't provide webhosting as such; we only provide tools for a Knowledge Base and Community. Any other web presence you wish to have will need to be hosted elsewhere.

    As far as the hostmapping goes, it's not necessary (and I think not even possible) to set up both a CNAME record and an A record pointing to the same site. When you set up your CNAME record with your DNS provider, Zendesk actually takes care of pointing that CNAME in the right direction so everything resolves correctly. You don't need to set up the A record yourself.

    Hopefully that answers your questions! Please let me know if you have any other questions!

  • 0

    Hi Jessie,

    Sorry, maybe I wasn't clear. What I want is for the whole domain name (example.com) to be mapped onto my Zendesk, not a sub-domain (support.zendesk.com). I'm pretty sure DNS rule dictate that you can't just have a CNAME entry - you must have at least one A record (with an IP address). So I need to create an A record for the example.com domain.

  • 0

    Hey Paul! Thanks for clarifying.

    Your root level domain (ie: www.example.com) is hosted with the domain registrar you bought it from, or with whatever web hosting services you're pointing it toward. In order to be able to use that root level domain for your Help Center, Zendesk would have to actually be your domain host and, as we talked about above, Zendesk isn't set up for that.

    So to answer your initial question, it's not possible to host map www.example.com to your Help Center. What you can do, however, is forward traffic from www.example.com to support.example.com. You'll set up your host mapping as described in the article above, pointing support.example.com to yourdomain.zendesk.com. You'll then do some additional set-up with your domain registrar to forward or redirect visitors to www.example.com to support.example.com.

    When you set up your host mapping with Zendesk, we take care of pointing your visitors to the correct IP address so you don't need to set up any of that on your own. When setting up forwarding from your root URL, though, the settings may be different. Your domain registrar will have instructions on how to get that set up!

    Please let me know if you have any other questions!

    (First paragraph edited for clarity.)

  • 0

    Sorry, Jessie, but that's wrong. The www. sub-domain can be mapped to Zendesk with a CNAME record.
    The root-level domain is 'example.com'. Only an A type record can be used with the root, according to the DNS specification. This requires an IP address, and it sounds like Zendesk can't provide/support that, which is a shame.

Powered by Zendesk