Multi-tenant SaaS is the hardest domain-security surface. You’re responsible for:
- Your own domain — same SSL / DNS / DMARC / blacklist / subdomain-takeover concerns as any business
- Custom-domain customers — tens or hundreds of thousands of customer domains pointing CNAMEs at your infrastructure, expecting valid certs and correct mail auth
- Send-as-customer mail — outbound mail using customer domains in the From header, requiring per-customer DMARC alignment
- Churn cleanup — customer leaves; their CNAME still points at your infra; a new signup with the same handle could take over their subdomain
Miss any of these and it becomes support tickets, deliverability degradation, or worse — a public subdomain-takeover story.
Vector 1 — Send-as-Customer DMARC Alignment
Your SaaS sends notifications, receipts, and marketing on behalf of customers. From address: [email protected]. Your infrastructure sends the mail.
For DMARC to pass, either:
- The customer publishes an SPF record including your sending infrastructure (
include:_spf.your-saas.com), and DKIM signs with a key published under their domain, OR - Your mail relays via the customer’s own SMTP (rare)
Path 1 is standard. Customers add CNAMEs like k1._domainkey.customer-brand.com CNAME k1.your-saas.com. That publishes your DKIM public key under their domain. You sign, aligned to customer’s domain, DMARC passes.
Half your customers get this wrong. Half of THOSE get partway there and don’t complete the setup. Their mail hits spam. They open support tickets asking why “your product’s mail” is failing.
DomainScan verifies each customer’s alignment continuously. Their DKIM CNAME missing? DomainScan flags it. Their SPF include missing? Flagged. Your customer success team surfaces the issue proactively.
Vector 2 — Custom-Domain SSL at Scale
Customers point customer-brand.com (or app.customer-brand.com) at your infrastructure via CNAME or A record. You terminate TLS. You issue certs — typically Let’s Encrypt via ACME automation, sometimes AWS Certificate Manager, sometimes a private CA.
For each customer domain you’re responsible for:
- Cert issuance (successful?)
- Cert renewal (working?)
- Cert validity (not expired?)
- Cert chain served correctly?
At tens of thousands of customer domains, silent failures happen. ACME rate limits hit. DNS misconfiguration prevents validation. Certs stall in “pending” state and never issue. Renewals fail and you don’t notice until the cert has been expired for six hours and customer complaints start.
DomainScan monitors every customer domain’s cert lifecycle. Prism AI diagnoses the failure mode (“DNS-01 challenge failing because the customer removed their CAA record”) and delivers the fix.
The 47-day cert timeline makes this worse — 8× more renewals by 2029. Automation you get away with today falls over at that cadence.
Vector 3 — Churn Cleanup + Subdomain-Takeover Risk
Customer signs up as acmeco on your platform. Their subdomain: acmeco.your-saas.com. Their custom domain CNAME: acmeco.customer-brand.com → acmeco.your-saas.com.
Customer churns. Their custom domain CNAME still points at your infra. acmeco.customer-brand.com still resolves. It hits your platform, which serves a “This subdomain is not configured” page — until someone else signs up as acmeco on your platform.
Now the new customer serves content from the churned customer’s domain. Best case: confusion. Worst case: deliberate takeover, phishing content served from the original customer’s brand domain.
Fix: enumerate customer domains regularly, flag those pointing at your infra without an active tenant, contact original customer or reject new signups reusing the handle. DomainScan’s subdomain finder automates the detection.
Vector 4 — Your Own SPF Include
You provide include:_spf.your-saas.com to every customer. That includes a chain of IPs. When you add a new sending region or ESP, you update your include chain. Every customer’s SPF still counts against the RFC 7208 10-lookup limit.
If your include chain grows too long, every customer’s SPF PermErrors. Mail bounces. Customer support burns.
DomainScan tracks your include’s lookup count and alerts when it approaches the limit.
The Integrated SaaS Setup
- Your own domain in DomainScan — standard monitoring
- API integration — pipe every customer domain into DomainScan on signup; remove on churn
- Per-customer trust score — surface in your admin console as “domain health”
- Alerts routed to customer-success — for customer-side issues (missing DKIM CNAME, SPF gap)
- Alerts routed to platform team — for your-side issues (SPF include chain, cert renewal, subdomain-takeover risk)
Bottom Line
Multi-tenant SaaS domain-security is a distinct discipline. Solve it with continuous per-tenant monitoring instead of quarterly manual audits. DomainScan is the platform.
Related
Read what DMARC is, the DKIM selector glossary entry, and how to audit subdomains for takeover.