Explicit security boundaries

Only the right host reaches your app.

Hostname, organization, HTTPS destination and certificate checks narrow every route before customer traffic can reach your origin.

Review the API model Contact security

Unknown host → 421SNI must match HostHTTPS origin only

A route exists only after its certificate does.

The control plane does not publish a hostname directly from an API write. DNS must validate, certificate material must pass validation and only then is the route made available to the edge.

Explicit hostname registration

The resource is bound to one organization and one validated HTTPS destination.

status: pending_dns

Certificate validation

The certificate and private key are checked for the requested identifier before storage.

dns: valid · certificate: issued

Guarded route publication

The route is published only when usable certificate material exists.

routing_status: active

Three boundaries before your code.

Each boundary rejects a different class of unwanted traffic or unsafe configuration.

Edge Host + SNI

Registered hostnames only.

SNI must match the HTTP Host header, and a route key must exist. Unknown or mismatched hostnames stop with HTTP 421.

HTTPS destination SSRF guard

Public HTTPS only.

Ports are limited to 443 and 8443. Private, reserved, link-local, metadata and CGNAT addresses are rejected.

Account Scoped keys

Organization-bound access.

API principals carry an organization and scopes; resource lookups reject identifiers owned by another organization.

Threat to observable result

Each control fails closed at a named boundary.

The result is visible as an HTTP response, rejected API write or lifecycle status—not hidden inside a generic health badge.

ThreatControlObservable result

Unregistered hostnameExplicit route lookupHTTP 421

SNI / Host mismatchRequest hostname comparisonHTTP 421

Private or reserved originHTTPS destination SSRF policyDestination write rejected

Cross-organization resource IDOrganization-scoped lookupResource access rejected

Stale webhook signatureTimestamped HMAC verificationDelivery rejected

DNS drift after activationActive-domain DNS sweepmisconfigured + route removed

HTTPS destination policy

Unsafe origins never become routes.

Validation happens when the HTTPS destination is created. URLs with credentials, query strings or fragments are rejected, and the resolved IP set is stored with the destination used by the published route.

Scheme: HTTPS required
Ports: 443 or 8443
URL user info: Forbidden
Resolved addresses: Public ranges only
Origin redirects: Not followed by webhooks

Security boundary

Infrastructure controls do not replace application controls.

The custom-domain layer narrows which requests reach your origin. Your application remains responsible for the user and tenant decisions made after that boundary.

subdomain.to Edge

Hostname and certificate boundary.

DNS verification, certificate lifecycle, registered-host routing and HTTPS destination policy.

Your product Application

Identity and tenant boundary.

Customer authorization, hostname-to-tenant mapping, user access and origin availability.

Not replaced Adjacent layers

Your wider security stack still applies.

The product does not replace a CDN, application WAF, tenant authorization or origin monitoring.

Verify the edge boundary

curl -i "https://$CUSTOMER_HOST/" \
  -H "Host: unknown.example"

HTTP/1.1 421 Misdirected Request

A reproducible negative test

Prove that a mismatched host stops at the edge.

Use one of your registered customer hostnames as $CUSTOMER_HOST, then send a different HTTP Host header. The TLS SNI and Host mismatch is rejected before the request reaches your HTTPS destination.

Certificate persistence: AWS KMS server-side encryption
API key storage: SHA-256 hash
Webhook signature: HMAC-SHA256
Control plane region: eu-west-3
Disclosure: security@subdomain.to

Material and messages

Secrets are not ordinary fields.

Certificate objects are persisted to the configured S3 bucket with KMS encryption. API keys are hashed. Webhook endpoint secrets are returned on creation and used to sign the untouched delivery body.

Security questions

Controls you can reason about.

What does the origin receive as Host?

The edge uses the destination host for the upstream Host header and preserves the customer hostname in X-Forwarded-Host.

How do I verify a webhook?

Parse SubdomainTo-Signature, compute HMAC-SHA256 over timestamp + "." + raw_body, compare in constant time and reject stale timestamps.

Can DNS drift leave a route open?

Active domains are swept. When DNS no longer matches, the domain moves to misconfigured and its route is removed.

Where is the control plane operated?

The production control plane and certificate storage are configured in AWS region eu-west-3.

Evaluate the implemented boundary

Test with a customer domain, then review the request model.

Use the same lifecycle and hostname controls in the dashboard, API and SDKs. Send responsible disclosures directly to the security inbox.

Test with a customer domain Contact security