Naked domain abc.com not rendering while www.abc.com renders correctly on AEM Cloud

[NageshRaja]

Hi all,

We have a strange issue in our setup - We are using Imperva as WAF and has been configured correctly by doing the below things following Customer managed CDN points to AEM managed CDN-

1. Point WAF to the Adobe CDN’s ingress as its origin domain.

2. Set SNI to the Adobe CDN’s ingress.

3. Set the Host header to the origin domain. For example: Host:publish-p<PROGRAM_ID>-e<ENV-ID>.adobeaemcloud.com.

4. Set the X-Forwarded-Host header with the domain name so AEM can determine the host header. For example: X-Forwarded-Host:example.com.

5. Set X-AEM-Edge-Key. The value should be configured using a Cloud Manager config pipeline, as described in this article.

Once done the requests from www.abc.com are getting routed to AEM successfully but the request from naked domain "abc.com" are not working.

The certificate installed at WAF is valid for both abc.com and www.abc.com so it should have worked same for both.

So we are left with the situation where in abc.com is not getting served and displays the below -

Any pointers on why the setup behaves as such?

Regards,

Naga

[AmitVishwakarma]

Hi @NageshRaja ,

Adobe AEM as a Cloud Service does not automatically support the apex/naked domain (abc.com) unless explicit configuration is done on both Imperva WAF and DNS/CDN level.

Try below steps:

Step 1: Configure DNS to Point Apex to Imperva WAF

If you're using a naked domain (abc.com), CNAME records won’t work (as CNAME is not allowed at the apex in most DNS providers).

You must:
  - Use ANAME or ALIAS record (supported by providers like Cloudflare, AWS Route 53, DNSMadeEasy).
  - Or use A records pointing to Imperva WAF edge IPs (confirm with Imperva).

Step 2: Ensure WAF is Handling abc.com Separately
Even though the certificate covers abc.com, Imperva must have a separate policy/config for the apex domain, not just www.abc.com.

Verify:
  - That abc.com is added as a separate domain/entry in Imperva.
  - The Origin (Adobe CDN ingress) is same as www.abc.com.
  - The Host header, SNI, X-Forwarded-Host, and X-AEM-Edge-Key are set identically for both domains.
Example for abc.com at WAF:

Origin: publish-p<PROGRAM_ID>-e<ENV_ID>.adobeaemcloud.com
SNI: publish-p<PROGRAM_ID>-e<ENV_ID>.adobeaemcloud.com
Host: publish-p<PROGRAM_ID>-e<ENV_ID>.adobeaemcloud.com
X-Forwarded-Host: abc.com
X-AEM-Edge-Key: <value-from-cloud-manager>

Step 3: Verify AEM Domain Mapping

Make sure both www.abc.com and abc.com are mapped in AEM Domain Mapping UI (via Admin Console):

  - Login to AEM as a Cloud Service Admin

  - Go to Tools > Cloud Services > Domain Mapping

  - Add both abc.com and www.abc.com with their respective SSL domains and environments.

Step 4: Redirection (Optional but Recommended)

Decide:

  - Do you want to serve content from both domains?

  - Or force redirect from abc.com to www.abc.com?

If redirect is preferred:

  - Do it at WAF level or DNS/CDN level, not in AEM.

Imperva can handle this as a custom rule:

If request.host == "abc.com" then 301 Redirect to "https://www.abc.com" + request.uri

Note:

Naked domain requires extra handling due to DNS limitations (no CNAME at apex).

Confirm all settings in Imperva for abc.com mirror those of www.abc.com.

Regards,
Amit

[narendragandhi · Accepted solution]

Hi @NageshRaja 

301 redirect from abc.com to www.abc.com is the recommended way to complete this setup. Curious on the use case for why you would also try to load AEM from abc.com directly as well.

I found this blog with instructions on how to complete the redirect setup in Imperva site - https://docs.imperva.com/bundle/cloud-application-security/page/settings/delivery-settings.htm

Hope this helps!

Thanks

Narendra

[Rohan_Garg]

As mentioned by @narendragandhi, 301 redirect is the way to go!

We use Imperva WAF in our system and have a redirect for the same. Hope this helps!

Regards,

Rohan Garg