diff --git a/pkg/complianceportal/management/domain_service.go b/pkg/complianceportal/management/domain_service.go
index 5cbb4ef31..0d272eba6 100644
--- a/pkg/complianceportal/management/domain_service.go
+++ b/pkg/complianceportal/management/domain_service.go
@@ -140,6 +140,24 @@ func (s *Service) RemoveCustomDomain(
 	)
 }
 
+func (s *Service) IsCustomDomainVerified(ctx context.Context, host string) (bool, error) {
+	certificate, err := s.certManager.GetByHostname(ctx, host)
+	if err != nil {
+		if errors.Is(err, coredata.ErrResourceNotFound) {
+			return false, nil
+		}
+
+		return false, fmt.Errorf("cannot load certificate: %w", err)
+	}
+
+	switch certificate.Status {
+	case coredata.CertificateStatusActive, coredata.CertificateStatusRenewing:
+		return true, nil
+	default:
+		return false, nil
+	}
+}
+
 // GetDomain returns a custom domain by ID.
 func (s *Service) GetDomain(
 	ctx context.Context,
diff --git a/pkg/complianceportal/visitor/service.go b/pkg/complianceportal/visitor/service.go
index d101b6a8a..803fa4632 100644
--- a/pkg/complianceportal/visitor/service.go
+++ b/pkg/complianceportal/visitor/service.go
@@ -220,6 +220,20 @@ func (s *Service) GetPortalByDomainName(ctx context.Context, domain string) (*co
 	return compliancePage, err
 }
 
+func (s *Service) IsVerifiedRedirectHost(ctx context.Context, host string) bool {
+	if _, err := s.GetPortalByDomainName(ctx, host); err != nil {
+		return false
+	}
+
+	verified, err := s.management.IsCustomDomainVerified(ctx, host)
+	if err != nil {
+		s.logger.ErrorCtx(ctx, "cannot check custom domain verification", log.Error(err), log.String("host", host))
+		return false
+	}
+
+	return verified
+}
+
 // GetPortalEmailPresenterConfigByOrganizationID resolves the emails.PresenterConfig for
 // the compliance page that belongs to the given organization. This is used by the
 // esign certificate worker which needs per-org branding at render time.
diff --git a/pkg/server/api/api.go b/pkg/server/api/api.go
index 9a08f65ad..6b5e4a3db 100644
--- a/pkg/server/api/api.go
+++ b/pkg/server/api/api.go
@@ -257,9 +257,7 @@ func NewServer(cfg Config) (*Server, error) {
 					return true
 				}
 
-				_, err := cfg.Visitor.GetPortalByDomainName(ctx, host)
-
-				return err == nil
+				return cfg.Visitor.IsVerifiedRedirectHost(ctx, host)
 			},
 			cfg.GraphQLLimits,
 		),
diff --git a/pkg/server/api/complianceportal/v1/mux.go b/pkg/server/api/complianceportal/v1/mux.go
index 875a1f7c4..98c85a502 100644
--- a/pkg/server/api/complianceportal/v1/mux.go
+++ b/pkg/server/api/complianceportal/v1/mux.go
@@ -67,8 +67,7 @@ func NewMux(cfg MuxConfig) (http.Handler, error) {
 	r.Get("/sitemap.xml", markdownHandler.HandleSitemap)
 
 	allowedHost := func(ctx context.Context, host string) bool {
-		_, err := cfg.Visitor.GetPortalByDomainName(ctx, host)
-		return err == nil
+		return cfg.Visitor.IsVerifiedRedirectHost(ctx, host)
 	}
 
 	oauthInitiateHandler := NewOAuthInitiateHandler(