Verification link domain — Certivus Help

Use the Settings → Integrations → Verify domain card to swap the host on every KYC verification link your clients click — from app.certivus.com/verify/… to verify.your-firm.co.uk/verify/….

This is part of the White-label add-on. If you see a paywall card instead of the setup form, contact us to enable the bundle.

Why bother

The verify link is the single most-clicked URL your firm sends to clients. Today it shows the Certivus domain in the browser bar; with this card, it shows yours.

Brand trust. A first-time KYC client sees https://verify.rraccountants.uk/verify/… and recognises your firm immediately. They see https://app.certivus.com/verify/… and may worry it's a phishing attempt.
Phishing resilience. Once your team is used to telling clients "you'll get a link from verify.our-firm.co.uk", impersonators who send links from any other host are easier to spot.
Forwarding-friendly. Clients forward verification links to spouses / co-directors all the time. The forwarded link looks like your firm, not ours.

This is independent of your portal domain (where your staff log in). You can have a verify domain without a portal domain, or both.

Who can use this

Your firm needs the White-label add-on (a monthly retainer; one entitlement covers all four white-label cards).
Within your firm: firm-owners and managers can register, verify, or remove the domain.

Pick a domain

A dedicated subdomain is recommended over your apex domain. Common patterns:

✅ verify.your-firm.co.uk — the obvious choice
✅ kyc.your-firm.co.uk
✅ secure.your-firm.co.uk
⚠️ your-firm.co.uk (apex) — works, but you usually want this for your marketing site

Setup walkthrough

Click "Connect your verify domain" and enter the host, e.g. verify.your-firm.co.uk. Lowercase, no https://, no trailing slash.
Add the two DNS records the card shows:
- A TXT record at _certivus-verify.verify.your-firm.co.uk with the token shown. Proves ownership.
- A CNAME record at verify.your-firm.co.uk → cname.vercel-dns.com. Routes traffic.
- For apex domains only: replace the CNAME with an A record → 76.76.21.21.
Click Verify. DNS propagation is usually 5–30 minutes. Retry as needed.
We provision SSL automatically. Card flips to Verified; verification links emitted from then on use your host.

What changes after verification

Every new verification invite email has its KYC link built on your host.
The 48-hour reminder cron for unopened verifications also uses your host on new reminders.
In-flight links already sent (before verification) keep pointing to app.certivus.com. They continue to work — we don't break existing client links — but they don't retroactively flip to your host.

If you want to know which links currently point where: check the Sent column on each client's verification log. New rows show your host; old rows show the previous host.

Removing the verify domain

Click the trash icon, confirm, and the domain detaches immediately.

New verification links from then on use app.certivus.com/verify/….
In-flight links already on your host stay on your host until they expire (default 7 days). Don't delete the CNAME at your registrar until those have expired.
You can re-register the same domain later if you change your mind.

DMARC + sender alignment (optional, advanced)

If you've also configured your sending email domain to align with your verify domain (e.g. emails come from compliance@your-firm.co.uk and links go to verify.your-firm.co.uk), Gmail and Outlook treat the combination as a strong domain-aligned signal. Clients are less likely to see the message marked as suspicious.

This is one of the reasons we encourage firms to set up both cards together rather than just one.

Common questions

Does this affect the KYC portal that clients actually fill in? Yes — the entire portal at /verify/:token is served on your host once the link routes there. The page is the same Certivus-built UI under the hood (we haven't built per-firm portal customisation yet beyond the branded theme), but the URL and SSL certificate are yours.

What about emails I've already sent? Already-sent links stay on the host they were built on. We don't rewrite history.

Can I have multiple verify domains? No, one per firm. Pick a single canonical host.

Does this work with email aliasing / forwarding? Yes. The link is a URL — it doesn't care how the email gets to the recipient.

Troubleshooting

Verification fails with "DNS TXT record not found":

Same checklist as the portal domain card. Confirm the TXT record exists at the exact host shown (note the _certivus-verify. prefix), with the exact token value, no extra quotes.
Wait 10 minutes for propagation. Use dnschecker.org to confirm globally.

Verification fails with "DNS routing not configured":

The CNAME (or A record for apex) didn't point at Vercel when we checked. Confirm cname.vercel-dns.com for subdomains, 76.76.21.21 for apex.
Cloudflare users: orange cloud (proxy mode) must be OFF for our CNAME.

Link opens but shows "Site not found":

DNS resolved but SSL hadn't provisioned yet. Wait 2 minutes and refresh. If still broken after 10 minutes, click Re-verify on the card.