Create Domain

Tenant^*

Application^*

Brand

Requires auth

Primary canonical

At most one active primary domain per (tenant, brand, application).

Hostname

https://

A leading `*.` registers a QA wildcard that matches any single sub-label. Wildcards cannot require auth or be primary.