diff --git a/src/common/tls-probe.ts b/src/common/tls-probe.ts
index 2aca672..a3ff4f6 100644
--- a/src/common/tls-probe.ts
+++ b/src/common/tls-probe.ts
@@ -1,6 +1,8 @@
 import * as tls from 'tls';
 
 const DEFAULT_TIMEOUT_MS = 4000;
+const DASHBOARD_BUSINESS_HOST = 'business.meshkee.com';
+const DASHBOARD_CUSTOMER_HOST = 'customer.meshkee.com';
 
 export type TlsProbeResult = {
   ok: boolean;
@@ -8,6 +10,22 @@ export type TlsProbeResult = {
   expiresAt: Date | null;
 };
 
+/**
+ * Tenant dashboard names CNAME to Meshkee dashboards. The API VM resolver often
+ * NXDOMAINs those CNAMEs even when public DNS (and browsers) are fine — so TCP
+ * to the known dashboard host and use the tenant name only as SNI/identity.
+ */
+function tcpHostForTlsProbe(sniHost: string): string {
+  const host = sniHost.trim().toLowerCase();
+  if (host.startsWith('business.') && host !== DASHBOARD_BUSINESS_HOST) {
+    return DASHBOARD_BUSINESS_HOST;
+  }
+  if (host.startsWith('customer.') && host !== DASHBOARD_CUSTOMER_HOST) {
+    return DASHBOARD_CUSTOMER_HOST;
+  }
+  return host;
+}
+
 function peerMatchesHost(host: string, socket: tls.TLSSocket): boolean {
   const cert = socket.getPeerCertificate(true);
   if (!cert || Object.keys(cert).length === 0) {
@@ -64,7 +82,7 @@ export function probeTlsHostDetailed(
     try {
       socket = tls.connect(
         {
-          host,
+          host: tcpHostForTlsProbe(host),
           port: 443,
           servername: host,
           rejectUnauthorized: true,