First-Party Domains

[#1]

Learn about first-party domains and how to configure your own domains and SSL/TLS certificates for data collection and delivery solutions in the Tealium Customer Data Hub.

To use first-party domains, you must have access to update your DNS database entries. You should be prepared to work with your "ProdOps" team or the person responsible for your domain registration or SSL/TLS certificates.

In this article:

• About First-Party Domains
• How It Works
• Managed and Imported Certificates
• Validating Domain Ownership
• Data Collection Domains
• Tag Management Delivery Domains
• Managing Domains and Certificates
• Selecting a Service to Configure
• Configuring a Certificate Managed by Tealium
• Providing Your Own Certificate
• Entering Domains
• Confirmation
• Domain Statuses
• Using First-Party Domains
• Tag Management
• Tealium Collect

About First-Party Domains

By default, the services offered in the Tealium Customer Data Hub are hosted on Tealium domains. Since these domain names don't match the domain of your brand's website, they are considered third-party domains. For example, the JavaScript files for Tealium iQ Tag Management are served from the domain tags.tiqcdn.comand the data collection endpoint for Tealium EventStream API Hub uses the domain collect.tealiumiq.com.

However, as new privacy regulations come out and as browsers begin limiting third-party capabilities, you might want to use your own domain to ensure that Tealium services are treated as first-party. First-party domains benefit from improved tracking and better compliance with browser privacy and cookie settings,

How It Works

To use your own domain name for tags.tiqcdn.com, you must create a CNAME entry in your DNS database. A CNAME record specifies a subdomain prefix to point to another domain. For example, the website www.example.com might have a CNAME for tags.example.com that points to Tealium's CDN to serve the files for iQ Tag Management. For collect.tealiumiq.com, you add A records to your DNS configuration. An A record specifies the IP address for the domain.  

A critical part of this configuration is the management of the SSL/TLS certificates, which are the public key certificates that verify the encryption of your website over HTTPS. The Tealium first-party domain feature helps you manage which domains you want to use with Tealium services and validates the SSL/TLS certificates for those domains.

Managed and Imported Certificates

You configure first-party domains by either importing your own certificates or by requesting certificates to be managed by Tealium. Imported certificates work the same as managed certificates, but with one important exception: imported certificates are not automatically renewed.

To use your own certificates, you must have access to the following SSL/TLS certificate files:

• PEM-encoded certificate
• PEM-encoded, unencrypted private key
• PEM-encoded certificate chain

To request certificates managed by Tealium, you must have access to edit your DNS entries or have access to receive email messages sent to the domain administrator.

Limits on Domains per Certificate

The maximum number of domains per certificate is determined when you sign up for first-party domains. The first-party domains overview screen shows the maximum number of domains per certificate. In the following example, no domains have been mapped and the maximum number of domains is 10.

Validating Domain Ownership

Before Tealium can issue a certificate for your site, you must prove that you own or control all the domains in your request. You can prove ownership using either DNS validation or email validation.

We recommend DNS validation because it is usually a quicker process and because sometimes it can be difficult to track down who in your organization has access to the administrative emails. However, if you don't have access to edit your domain's DNS database, then you must use email validation.

DNS Validation

To use the DNS validation method, you must have access to edit your DNS configuration.

After you enter your domains, you are provided with temporary CNAME records for each domain requested, which you must add to your DNS configuration. 

After the DNS update for the temporary CNAME records propagates (which may take several hours), the ownership is confirmed and permanent DNS records (CNAME records for tags.tiqcdn.com  or A records for collect.tealiumiq.com) are provided in the DNS Confirmation screen. You must then update your DNS configuration with the permanent records.

Email Validation

To use email validation, you must be able to receive email messages at one of the contact addresses listed in the WHOIS database for each of your requested domains. The email addresses that will receive a message include:

• administrator@your_domain
• hostmaster@your_domain
• hostmaster@your_domain
• postmaster@your_domain
• webmaster@your_domain
• admin@your_domain

You will receive an email message (one for each domain) from Amazon Web Services containing a validation token that expires in 72 hours. If you do not receive the email or the token has expired, return to the main screen and click Resend Email.

Data Collection Domains

Use first-party domains with Tealium EventStream API Hub and Tealium AudienceStream CDP for first-party data collection. 

The following data collection services and domains can be mapped to your first-party domain:

Tealium Service	Third-Party Domain	First-Party Example
Tealium Collect	collect.tealiumiq.com	collect.example.com

To use your first-party domain with a service not listed here, such as Data Layer Enrichment or the View-Through Extension, contact Tealium Support Desk.

Tag Management Delivery Domains

Use first-party domains with Tealium iQ Tag Management to maintain core functionality as browsers adopt stricter privacy policies such as ITP and ad blockers.

The following tag management services and domains can be mapped to your first-party domain:

Tealium Service	Third-Party Domain	First-Party Example
iQ Tag Management Files (utag.js, utag.sync.js, utag.#.js)	tags.tiqcdn.com	tags.example.com

Managing Domains and Certificates

Contact Tealium Support Desk to enable this feature in your account.

To configure first-party domains for your account, you must have the Manage Account permission. 

To get started, navigate to iQ Tag Management > User Menu > First-Party Domains.

Selecting a Service to Configure

Determine which of the following services to configure:

• Server-Side Data Collection/DLE
  Map one or more of your domains to Tealium to allow first-party data collection for EventStream and AudienceStream.
• Client-Side Delivery
  Map one or more of your domains to Tealium to allow first-party file delivery.

Domains and certificates for Collection and Delivery are managed separately.

Next, click Configure Certificate and select one of the following:

• Generate Certificate
  Tealium generates and manages the SSL/TLS certificate.
• Provide Certificate
  Upload your own certificate files. If you use your own certificate, Tealium cannot automatically renew it.

Configuring a Certificate Managed by Tealium

Select a Region

To configure a domain and certificate for data collection, select the region in which your primary account operates:

• Germany
• Hong Kong
• Ireland
• Sydney
• Tokyo
• US East

Select the Type of Validation

• DNS Validation
  To validate using DNS, you will be provided temporary DNS records to add to your DNS database. After these records are propagated and validated, you will be provided permanent records to replace the temporary records. You must have access to edit your DNS configuration and update the configuration with the permanent records.

• Email Validation
  To validate using email, an email message will be sent to the administrator email address associated with the requested domains. You must be able to receive these email messages to validate your ownership of the domains. You will receive one email message for each domain containing a validation token that expires in 72 hours. If you do not receive the email or the token has expired, return to the main screen and click Resend Email.

Accept the Agreement

To continue, accept the agreement to allow Tealium to manage certificates for the provided domains.

Providing Your Own Certificate

If you prefer to use your own certificate you can upload your certificate files. If you use your own certificate, Tealium cannot automatically renew it.

Upload the following files to use your own certificate:

• Certificate
• Private Key
• Certificate Chain

Re-importing a Certificate

If you need to re-import a certificate that contains new or updated domains, you need to remove the current certificate and re-import it.

Entering Domains

The first-party domain you specify will usually be a subdomain of your customer-facing website. For example, the website located at www.example.com would use a subdomain named tags.example.com as a first-party domain for tag management services.

Enter the first-party domain you want to use, omitting https:// and the ending slash. To enter another domain, click + Add Domain, otherwise click Next.

First-party domains apply to all profiles in your account, so enter a subdomain for each site managed by this account.

View Domain Contact Info

After you enter a domain, click View Contact Info to view the WHOIS database information for that domain. If the WHOIS database contains contact information for the domain, such as a name, mailing address, email address, or phone number, it will be displayed here to help you verify the entry.

Click + Add Another Domain to add additional domains. Click Next when you have finished entering domains.

Confirmation

The following message is displayed while your domain information is being validated:

 Please wait while domain information is validated. This won't take long.

Email Validation

You will receive an email message for each domain entered that contains a validation token that expires in 72 hours. For each validation email that you receive, verify that the domain information is correct and click the link provided in the email to approve the request.

If you do not receive the email or the token has expired, return to the main screen and click Resend Email.

DNS Validation

The confirmation screen displays one or more permanent DNS records that are used to validate your domain ownership.

When you first request the certificate, temporary DNS records (CNAME records or A records) are displayed for validation purposes, after which the permanent records are displayed.

Each record contains a Name and Value that you must enter into your DNS provider's web interface to update the records.

The record name appears in the format _X.sub.example.com. where X is a generated alpha-numeric string and sub.example.com is the first-party domain you entered.

Example record name:

_4c71ce829d13dacf824b18af1067d273.tags.example.com.

DNS providers are inconsistent in their handling of the record name (or name) field. In some cases, you are expected to provide the entire value as shown above, while other providers automatically append the domain name to the value you enter.

The record value is similar and appears in the format _X.Y.acm-validations.aws. where X.Y is a generated alpha-numeric string.

Example record value:

_6e23f25da49d05e43a419ea7c5f4162d.zzxlnyslwt.acm-validations.aws.

Domain Statuses

During the setup and validation process the domain certificate could appear with one of the following statuses:

• Issued: All domains are validated and the certificate is not expired nor about to expire.
• Expired: The certificate is expired.
• Pending Validation: One or more domains attached to the certificate are not validated.

The domain validation must occur within 72 hours. 

If the validation period expires, request a new certificate for the same domain. The DNS validation records are the same for subsequent requests of the same domain.

Using First-Party Domains

After your domains are configured and the certificates are validated you can begin using your first-party domains with the following services:

• Tag Management
• Tealium Collect

Tag Management

To use your first-party domain with iQ Tag Management you must also make the following changes:

• Update the Universal Tag (utag.js) code snippet wherever it is installed.
• Set the publishing URLs.
• Edit the template for utag.js to adjust the location of utag.v.js.

Update Universal Tag Loading Script

To update the Universal Tag code snippet:

1. Navigate to User Admin Menu > Code Center.
2. Under Choose Domain, select your first-party domain.
   

The example code snippet is updated to use your first-party domain.

The new URL only uses the profile name and environment in the path. The account name and /utag/ portions are omitted.

The URL to the Universal Tag on a first-party domain is:

https://sub.your_domain.com/PROFILE/ENV/utag.js

For example, the code snippet for tags.tealiumecommerce.com would be:

<!-- Loading script asynchronously -->
<script type="text/javascript">
    (function(a,b,c,d){
    a='https://tags.tealiumecommerce.com/ecomm/prod/utag.js';
    b=document;c='script';d=b.createElement(c);d.src=a;d.type='text/java'+c;d.async=true;
    a=b.getElementsByTagName(c)[0];a.parentNode.insertBefore(d,a);
    })();
</script>

Set Publishing URLs

The publishing URLs determine where to load the additional utag.#.js files for each default environment. If you forget this step, then the vendor tag files loaded after utag.js will not originate from your domain.

To set the publishing URLs:

1. Click Save/Publish, then click Configure Publish Settings....
2. Under Publishing URLs, enter a URL for each environment that uses your first-party domain.
   
   Dev: //sub.your_domain.com/your_profile/dev/
   QA: //sub.your_domain.com/your_profile/qa/
   Prod: //sub.your_domain.com/your_profile/prod/
3. Click Save.

Update Location to utag.v.js

Within the tag template for the Universal Tag (utag.js) there is code that loads an additional file used for reporting purposes named utag.v.js. You must update the path of this file to use your first-party domain, too.

To set a new location for utag.v.js:

1. Go to iQ Tag Management > Admin > Manage Templates.
2. In the Template drop-down list, select uTag Loader UID:loader.
3. Find the line that loads utag.v.js and change it to use your first-party domain.
   Default code:
   

   if(w>0 && b["cp.utag_main__ss"]==1 && !utag.cfg.no_session_count) utag.ut.loader({
       src:v.substring(0,v.indexOf("/ut"+"ag/")+6)+"tiqapp/ut"+"ag.v.js?a="+utag.cfg.utid+(utag.cfg.nocookie?"&nocookie=1":"&cb="+(new Date).getTime()),
       id:"tiqapp"
   })
   

   First-party domain code:
   

   if(w>0 && b["cp.utag_main__ss"]==1 && !utag.cfg.no_session_count) utag.ut.loader({
       src:"https://sub.your_domain.com/utag/tiqapp/utag.v.js?a="+utag.cfg.utid+"&cb="+(new Date).getTime(),
       id:"tiqapp"
   })
   

4. Click Apply.

After all of these changes, save and publish to apply the changes to your site.

Tealium Collect

To use your first-party domain with Tealium EventStream or Tealium AudienceStream you need to update the data collection URL in your installation of Tealium Collect. For websites this means setting the Server field of the Tealium Collect tag. 

To update the Tealium Collect tag:

1. Go to iQ Tag Management > Tags and expand the Tealium Collect tag.
2. In the Server field, enter your first-party domain endpoint.
   Example: https://sub.your_domain.com/your_account/your_profile/2/i.gif
3. Click Apply.

Collect for Mobile

For mobile apps you must override the dispatch URL in the Collect module.

Refer to the following settings to set your first-party domain endpoint:

• Tealium for Swift: config.overrideCollectURL
• Tealium for Android: config.overrideCollectUrl