Multi-Tenant Domain Infrastructure with Automated Provisioning

The Challenge

A domain portfolio can be managed with generic parking pages, manual DNS changes, and basic redirect services. Many investors do exactly that – even with thousands of domains. But generic solutions have limitations.

The goal for this project was to go beyond the basics:

• Dedicated, high-performance landing pages (not generic templates)
• Automated DNS and SSL provisioning (no manual configuration per domain)
• Intelligent lead capture tracking the buyer's journey across domains
• Spam protection without cookie consent walls
• Unified analytics across all tenant domains

Off-the-shelf parking services couldn't deliver this level of sophistication.

The Solution Architecture

To solve this, I designed and built a complete, end-to-end system composed of a multi-tenant frontend, a backend automation engine, and several integrated services.

Technical Highlights

1. Multi-Tenant Runtime

A single SvelteKit deployment serves all 1,000+ domains. Using Vercel's Edge Network, the application inspects the Host header to conditionally render either the main portfolio or a domain-specific landing page. This approach also utilizes a virtual URL strategy to aggregate all tenant traffic into a single, unified Plausible Analytics dashboard.

2. Automated Provisioning Pipeline

A CSV export from the domain registrar triggers an idempotent background job with WebSocket progress updates. The FastAPI backend orchestrates:

1. DNS zone and record creation (A, CNAME, MX) via the ClouDNS API
2. Catch-all mail forwarding configuration for inquiry emails
3. Domain addition to Vercel for automatic SSL certificate issuance
4. Sanity CMS sync to create marketing content entries

3. Lead Intelligence System

A cookie-free visitor intelligence system uses localStorage to track buyer journeys across domains. When a lead submits an inquiry, the backend enriches it with context like: "Returning visitor from Germany, viewed 3 other domains before inquiring."

4. Dual Spam Protection

The system uses a hybrid approach to spam prevention. The main portfolio site uses Cloudflare Turnstile. Tenant domains use a self-hosted ALTCHA (Proof-of-Work) solution to bypass Cloudflare's per-domain limits, including HMAC-signed challenges and replay-attack protection.