New Apex Domain Onboarding Checklist

Use for every new client apex domain added to the shared MainDomains server. Do not consider onboarding complete until every box is checked.

Setup

• Confirm which static-IP option applies for this client: Route 53 Alias, Global Accelerator, or dedicated server (see Static-IP Options Compared)
• If dedicated server: run new-apex-vhost.sh <domain> from the clean template — never copy an existing client's .conf file
• Confirm client has added the apex A record pointing to this server's static IP
• dig +short <domain> returns the expected IP

Before SSL issuance

• Port-80 vhost responds correctly for the domain: curl -s -o /dev/null -w "%{http_code}\n" --resolve <domain>:80:127.0.0.1 http://<domain>/
• Confirm HTTPS requests for the domain currently hit the catch-all (403), not another client's content — proves the safety net is active before the cert exists

SSL issuance

• sudo certbot --apache -d <domain> -d www.<domain>
• sudo apache2ctl configtest
• sudo systemctl reload apache2

Final verification

• apache2ctl -S — confirm 000-catchall is still listed as default for *:80 and *:443, and the new domain appears as its own namevhost
• curl --resolve test returns 301 with correct Location: header for both the new domain and all existing domains (regression check)
• Unmapped/random test domain still returns 403

Sign-off

• Vhost filename uses numeric prefix consistent with existing convention
• No hardcoded cert paths reference a different client's domain
• Change documented (date, domain, who onboarded)

← Back to the DNS series index