# What happens to the already assigned(by Auth0) domain when custom domain is added? **URL:** \ **Category:** Get Help\ **Tags:** custom-domain\ **Created:** [July 26, 2022, 10:04am UTC](https://community.auth0.com/t/what-happens-to-the-already-assigned-by-auth0-domain-when-custom-domain-is-added/87643 "2022-07-26T10:04:32Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![rajivk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rajivk/32/33874_2.png) [@rajivk](https://community.auth0.com/u/rajivk)\ **Post date:** [July 26, 2022, 10:04am UTC](https://community.auth0.com/t/what-happens-to-the-already-assigned-by-auth0-domain-when-custom-domain-is-added/87643/1 "2022-07-26T10:04:32Z")
We are planning to have custom domain with cloudflare as reverse proxy. I was curious to know what really happens behind the scene. When we create a custom domain, - What happens to default domain assigned to tenant like `travel.us.auth0.com`, does it still exist and cloudflare use it? - Does custom domain resolves to cloudflare IP or Auth0 load balancers? - How does Auth0 make sure that all traffic is routed through cloudflare, like through certificates? Is there any docs around the same? ---
**Author:** ![josiah\_devizia](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/josiah_devizia/32/33352_2.png) [@josiah\_devizia](https://community.auth0.com/u/josiah_devizia)\ **Post date:** [July 26, 2022, 1:15pm UTC](https://community.auth0.com/t/what-happens-to-the-already-assigned-by-auth0-domain-when-custom-domain-is-added/87643/2 "2022-07-26T13:15:00Z")
You can still use the default domain, I do in my post man recipes for the management api because it makes it more obvious which Auth0 tenant I’m working with. ---
**Author:** ![rajivk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rajivk/32/33874_2.png) [@rajivk](https://community.auth0.com/u/rajivk)\ **Post date:** [July 29, 2022, 2:31pm UTC](https://community.auth0.com/t/what-happens-to-the-already-assigned-by-auth0-domain-when-custom-domain-is-added/87643/3 "2022-07-29T14:31:15Z")
Is there a way that we can allow traffic only through cloudflare? I guess this custom domain resolves to cloudflare right? is there any docs around it? ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [July 29, 2022, 2:38pm UTC](https://community.auth0.com/t/what-happens-to-the-already-assigned-by-auth0-domain-when-custom-domain-is-added/87643/4 "2022-07-29T14:38:41Z")
Hey there @rajivk! Have you had a chance to check out our docs on Cloudflare as a reverse proxy and Custom Domains in general? > **[Configure Cloudflare as Reverse Proxy](https://auth0.com/docs/customize/custom-domains/self-managed-certificates/configure-cloudflare-for-use-as-reverse-proxy)** > > Learn how to set up Cloudflare for use as the custom domain proxy for Auth0. > [@rajivk](#): > > Is there a way that we can allow traffic only through cloudflare? > I guess this custom domain resolves to cloudflare right? The custom domain will resolve to Cloudflare and hence traffic, despite the Auth0 domain remaining active/available. ---
**Author:** ![rajivk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rajivk/32/33874_2.png) [@rajivk](https://community.auth0.com/u/rajivk)\ **Post date:** [July 29, 2022, 2:53pm UTC](https://community.auth0.com/t/what-happens-to-the-already-assigned-by-auth0-domain-when-custom-domain-is-added/87643/6 "2022-07-29T14:53:44Z")
If someone knows our tenant names they could directly reach out to our tenants bypassing our configurations at cloudflare, Right? ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [July 29, 2022, 3:21pm UTC](https://community.auth0.com/t/what-happens-to-the-already-assigned-by-auth0-domain-when-custom-domain-is-added/87643/8 "2022-07-29T15:21:33Z")
This is a valid (and known) shortcoming for which I encourage you to create a [Feedback Request](https://community.auth0.com/c/feedback/95). After doing some digging internally, the consensus is that there 2 attack vectors against canonical domain name bypass: - Authentication API: You may want to reach out to support (support ticket) to inquire about allowlisting your RP (relying party) IPs. - Management API: The `iss` (issuer) claim originating from your custom domain will be different, and as long as token validation is done against the custom domain name `iss` any bypass shouldn’t go unnoticed. ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [September 24, 2022, 12:28am UTC](https://community.auth0.com/t/what-happens-to-the-already-assigned-by-auth0-domain-when-custom-domain-is-added/87643/9 "2022-09-24T00:28:48Z")