It mirrors external-sp-proxy.rootly.com from Part D of the brief.
Customer hostnames point at this name. The proxy then routes on the
Host header, so this hostname never serves a tenant's page — you are
seeing this only because a page was attached to it deliberately, so it explains
itself instead of returning a bare 404.
To put your own domain behind it:
TXT record it gives you, then click VerifyCNAME your.hostname → external-sp-proxy.geiger.toStep 2 is the point: ACME proves routing control, not ownership. Without a separate proof, anyone who can point DNS here could claim a hostname that isn't theirs. Unverified hostnames 404 and cannot obtain a certificate.