White-Label Partner
Setting up your platform
Everything required to take your White-Label tenant from empty to live — domains, email, branding, payments, and the checks that confirm it actually works. Work through it in order. Each step assumes the one before it is done.
How to use this page
You do not need to understand DNS, SMTP, or SSL to finish this. Each step tells you exactly where to click and exactly what to type. Where a provider does not publish enough detail for us to be certain, we say so and ask for a screenshot rather than guess — a wrong DNS record is harder to unpick than an unmade one.
Nothing here asks you to send us a password, app password, secret key, or API credential. Every credential is entered directly into your own portal. If anyone asks you to send one, including someone claiming to be us, stop and call.
Step one
Gather this before you touch anything
Most stalled setups stall here — halfway through a DNS change, waiting on someone else's password. Collect all of it first and the rest takes an afternoon.
Your root domain
The domain the portals will live under, for example yourcompany.com.
Your Partner Portal Domain
Where you and your team sign in. Commonly admin.yourcompany.com, but it is whatever you enter in the platform.
Your Borrower Application Domain
Where your clients submit applications. Commonly app.yourcompany.com or apply.yourcompany.com.
Who you bought the domain from
The registrar. This is often NOT the company that controls your DNS.
Your current nameservers
This is what actually decides where DNS records must be created. Step 2 shows you how to find them.
Your business email provider
Google Workspace, Microsoft 365, a free consumer account, or email included with your web host. Each behaves differently.
Whether you have an existing website on this domain
So nothing you already run gets taken offline by a DNS change.
Admin access to all of the above
Not your web designer's access. Yours, or someone who can act immediately.
A note on who controls your DNS
- The company that sold you your domain is often not the company that controls its DNS records. This trips up more setups than any other single thing.
- If you moved your website to a builder like Wix, Squarespace, or Shopify, or put your domain behind Cloudflare, your DNS almost certainly moved with it.
- Step two shows you how to find out for certain in under a minute.
Step two
Point your domains at the platform
Two DNS records. That is the whole job. The difficulty is not the records — it is making them in the right place, with the right host value, without breaking the website or email you already run.
First: find who actually controls your DNS
- Go to lookup.icann.org and enter your domain.
- Read the Registrar Information section — that is who sold you the domain.
- Read the Nameservers under Domain Information — that is who controls your DNS.
- The company named in those nameserver addresses is where your records must be created.
If the nameservers say cloudflare.com, editing records at your registrar does nothing at all — Cloudflare is authoritative. The same is true for Wix, Squarespace, and any host you moved DNS to.
The two records you are creating
Both are type A. Both point to the same address. Only the host differs.
Where to find your exact values
Sign in to your portal and open Settings → Custom Domain. The “How to Setup DNS Configuration” panel shows both records with the exact Name/Host and the address to point them at. Copy the value from that screen — it is the authoritative source, and it stays correct even if the platform destination changes.
Partner Portal
- Type
- A
- Name / Host
- The subdomain label of your Partner Portal Domain
- Points to
- The address shown on your Custom Domain screen
Borrower Application Portal
- Type
- A
- Name / Host
- The subdomain label of your Borrower Application Domain
- Points to
- The address shown on your Custom Domain screen
The single most common mistake
- Almost every provider wants only the subdomain LABEL in the host field — admin, app, apply — and appends your domain automatically.
- Typing admin.yourcompany.com into a field that auto-appends produces admin.yourcompany.com.yourcompany.com, which resolves to nothing and gives no error.
- If your provider shows your domain greyed out beside the input, it appends. Enter the label only.
- The exception is a cPanel-style Zone Editor, which displays full hostnames in the list but still auto-appends what you type.
Do not delete records you do not recognise
- Your existing MX records carry your business email. Removing them stops mail immediately, and the sender gets no bounce for hours.
- TXT records that look like random strings are usually domain verification for services you still use — email, analytics, advertising, e-signature.
- The only records that ever need removing are a conflicting A, AAAA, or CNAME at the exact hostname you are configuring. Nothing else.
- If a record is in the way and you do not know what it does, send us a screenshot before deleting it.
Instructions for your provider
Open the one that matches where your DNS actually lives — not necessarily where you bought the domain.
How long this takes to work
- A brand-new hostname that never existed before usually resolves within minutes, not days. There is nothing cached to expire.
- Changing an existing record takes longer, because the old value stays in caches until its TTL expires.
- The 24 to 48 hour figure comes from internet providers that ignore TTL settings. It is a worst case, not an expectation.
- If it has been more than 48 hours, the record is wrong. Waiting longer will not fix it — go to the troubleshooting table.
Step three
Connect your outgoing email
This is how your platform sends notifications, receipts, and system alerts to your clients. It is the step partners most often rush, and the one that most often causes problems weeks later.
Choose the right option, not the fastest one
- Your business mailbox and your platform's sending account do not have to be the same thing, and usually should not be.
- A free consumer account is not a business email account. They behave differently in every way that matters here — sender identity, authentication, limits, and control.
- If you expect meaningful notification volume, a dedicated sending service is the durable answer. It is unaffected by mailbox provider policy changes.
Credentials
- Never send a password, app password, secret key, or API key to anyone — by email, by text, or in a support conversation. That includes us. We will never ask.
- Enter every credential directly into Settings, Email Configuration in your own portal.
- If you have already sent a credential to someone, revoke it and generate a new one rather than hoping.
Step four
Prove the mail is really from you
SPF, DKIM, and DMARC are three DNS records that tell the receiving mail server your notifications are legitimate. Without them, your mail goes to spam — or nowhere at all. With them wrong, the same.
If you remember one thing from this step
- Your domain may have exactly ONE SPF record. Adding a second one does not add a sender — it breaks SPF for your entire domain, which is worse than having none.
- To authorize another sender, edit the record you already have and add another include to it.
Step five
Make it yours
Settings, Branding. This is what your clients see, and it is the part of a white-label platform that either reads as your business or reads as somebody else's software with your name on it.
Fields and specifications
Site Name
Required
Your public brand name. This appears in the portal header and in notification subject lines.
Site Slogan
Optional
A short tagline. Leave blank rather than filling it with something you will regret.
Primary Logo (White Text)
Required — 420 × 127 px
Used on dark backgrounds. Transparent PNG. The white-text version, not your standard logo.
Secondary Logo (Black Text)
420 × 127 px
Used on light backgrounds. Transparent PNG.
Site Favicon
50 × 50 px, square
ICO or PNG with a transparent background. This is the small icon in the browser tab.
Primary Theme Color
Hex value, for example #1a3a5c
Your dominant brand color. Used for navigation and primary surfaces.
Secondary Theme Color
Hex value, for example #e7c30d
Your accent color. Used for highlights and calls to action.
Getting it right
- Upload the correct logo variant to each slot. The most common branding mistake is putting a dark-text logo in the Primary (White Text) slot, which renders as an invisible smudge on the dark navigation bar.
- Use transparent backgrounds. A white rectangle behind your logo is obvious against a colored header and looks unfinished to your clients.
- Match the aspect ratio rather than stretching. A logo squeezed into 420 × 127 from a square original looks distorted on every screen your borrowers see.
- Check contrast between your secondary theme color and white text before committing. A pale accent color makes buttons unreadable, and it is the button your borrower needs to press.
- There is a Reset control next to the theme colors. It restores platform defaults if you want to start over.
- Save Branding commits the changes. Reload the portal in a private browser window afterwards to see what a new client actually sees.
Step six
Connect how you get paid
Settings, Payment Integration. Four methods are available. Each has its own active toggle and its own sandbox and live environment, so review all four before launch rather than discovering later that one was live all along.
Worth knowing
- Authorize.Net is not currently a supported payment integration on the platform. If you need it, tell us — it is a product decision, not a configuration you are missing.
- Every provider carries its own Active toggle and Sandbox or Live environment. Review all four before launch so nothing is unintentionally live.
Step seven
Company details, users, and permissions
The details that appear on client-facing documents, and the decisions about who inside your business can do what.
Legal company name
Your registered entity name, matching your formation documents. Used on agreements.
Public brand name
What your clients call you. This can differ from the legal name.
Business address
Your real operating address. It appears on client-facing documents.
Support email and phone
Monitored channels. Do not enter an address nobody reads.
Notification sender name
The name your clients see in their inbox. Use your brand, not a person who may leave.
Reply-to address
Where replies actually land. Test this — a reply-to that bounces is worse than none.
Privacy Policy and Terms of Use links
Your own policies, reviewed by your own counsel. Do not point these at ours.
Administrative users
Who can change settings. Keep this list short and current.
Employee and user roles
Set under Roles & Permissions. Grant the minimum each person needs.
Product and service availability
Which offerings appear to your clients.
Calendar or appointment link
Your scheduling link, if you use one.
Access control
- Review Roles & Permissions before you add your team, not after. It is far easier to grant an additional permission than to work out who has been able to see what.
- Every administrator can change settings that affect live client experience. Two or three is usually right. Everyone is never right.
- When someone leaves, remove their access the same day. Platform access outlives an email account.
Your legal links are yours
Your Privacy Policy and Terms of Use must be your own documents, reviewed by your own counsel, covering your own business. Do not point them at ours. Your clients are contracting with you.
Step eight
Verify before you launch
Configuration is not completion. Work through every applicable item with your own eyes before a single real client touches the platform.
Launch readiness
0 / 28verified
Saved in this browser only. It is a working aid, not a record of completion.
Domains and security
0/6Access
0/6Notifications
0/5Brand and presentation
0/6Payments
0/5When it does not work
Troubleshooting
Find the symptom. Almost every setup problem is one of these, and almost none of them are propagation.
Symptom
The portal address does not load at all
Usually means
The A record was created at a provider that is not authoritative for your domain, or the host field contains the full hostname where only the label was expected.
What to do
Check your nameservers at lookup.icann.org to confirm who actually controls DNS, then confirm the record exists there with the label-only host value.
Symptom
It works sometimes and fails other times
Usually means
A second A record already exists for the same hostname. Traffic alternates between the old destination and the platform.
What to do
Edit the existing record rather than adding another. There must be exactly one A record per hostname.
Symptom
It works for some people but not others, on the same network
Usually means
An AAAA (IPv6) record exists for the hostname. Devices with IPv6 prefer it and never reach the platform.
What to do
Remove the AAAA record for that hostname only. Leave AAAA records on other hostnames alone.
Symptom
The DNS provider refuses to save the A record
Usually means
A CNAME record already exists at that name. A CNAME cannot coexist with any other record at the same name.
What to do
Find out what the CNAME points to and what it is currently serving. Confirm you are intentionally replacing that service, then remove the CNAME and add the A record.
Symptom
The browser shows a certificate or security warning
Usually means
On Cloudflare, the record is Proxied. Certificate validation reaches Cloudflare instead of the platform, so the certificate never issues.
What to do
Set both A records to DNS only — grey cloud, not orange — and allow time for the certificate to issue.
Symptom
The domain has been pending or unverified for over 48 hours
Usually means
Something is wrong with the record, not with propagation.
What to do
Verify the record type, the exact hostname, and the destination value. Genuine propagation delays past 48 hours are rare; a wrong record never resolves itself.
Symptom
Test mail fails to send
Usually means
An app password was not used where one is required, the credential was pasted with a trailing space, or SMTP authentication is disabled on the mailbox.
What to do
Re-enter the credential carefully. On Microsoft 365, confirm Authenticated SMTP is enabled for the mailbox and Security Defaults are not blocking it. On Amazon SES, confirm you used SMTP credentials rather than IAM access keys.
Symptom
Mail sends but never arrives
Usually means
Amazon SES is still in sandbox mode, or the recipient domain is silently rejecting unauthenticated mail.
What to do
Confirm SES production access has been granted. Then confirm SPF, DKIM, and DMARC all pass on a message you actually receive.
Symptom
Notifications land in spam
Usually means
SPF, DKIM, or DMARC is failing, or the From address does not align with the authenticated domain.
What to do
Check all three on a received message. The most common cause is a second SPF record on the domain, which invalidates SPF entirely.
Symptom
Email stopped working weeks after it was set up correctly
Usually means
An app password was revoked because the account password changed.
What to do
Generate a new app password and update it in Settings, Email Configuration.
Symptom
The logo is invisible or looks like a dark smudge
Usually means
A dark-text logo was uploaded to the Primary Logo (White Text) slot.
What to do
Upload the white-text version to Primary and the black-text version to Secondary.
Symptom
A payment fails immediately in testing
Usually means
The environment selector and the credential type disagree — live keys in Sandbox, or test keys in Live.
What to do
Confirm the key prefix matches the selected environment for that provider.
Still stuck
Send a screenshot, not a description.
Nine times out of ten we can see the problem immediately in a picture of your DNS screen or your settings page — and nine times out of ten a written description leaves out the one field that matters. Include the exact error text if there is one.
Book time with your implementation specialist.
Blank out nothing except credentials. We do not need, and will never ask for, a password, app password, secret key, or API key.