White label domain: what it is and how to set one up

The four things people mean by white label domain

The phrase covers four different jobs. They share one mechanism, a DNS record plus an HTTPS certificate, but they are bought, set up and priced differently. Find yours in the table, then jump to the matching guide.

The first two are the same mechanism seen from opposite sides. The vendor offers the feature and the customer adds the DNS record. If you build software, you are the vendor in that sentence, which is the job custom domains for SaaS exists to do.

How a white label domain works

Three things have to be true before app.example.com opens a vendor's product with your name on it.

1. DNS points the name at the vendor. You create a CNAME record, an alias from app.example.com to a hostname the vendor gives you. When someone visits, DNS follows the alias and returns the vendor's server addresses.
2. The vendor holds a certificate for your name. The browser sends the name it wants in the TLS handshake (Server Name Indication) and expects a certificate that covers exactly that name. Most vendors request one automatically from Let's Encrypt. A common check, called HTTP-01, fetches a file from your name over plain HTTP, so it only passes once your record points at the vendor. The record comes first and the certificate follows.
3. The vendor maps the name to your account. The server reads the Host header, finds the account that registered app.example.com, and serves your branded login or tenant. If the name was never registered, the visitor sees a generic vendor page or an error.

app.example.com.   300   IN   CNAME   edge.vendor.example.net.

That one line is the whole DNS side. Everything else is the vendor's job. When a white label domain fails, one of the three steps is missing, and the symptom tells you which: a DNS error points at step 1, a certificate warning at step 2, and a generic vendor page or a 404 at step 3.

White label, custom, vanity and branded domains

These terms overlap and search results mix them. This is how people use each one.

In practice a white label domain is a custom domain with a stricter goal: nothing the customer sees should name the vendor.

Subdomain or root domain

Use a subdomain whenever the vendor allows it. A CNAME works on a subdomain and cannot work on a root domain, because DNS does not let a CNAME share a name with other records (RFC 1034, RFC 2181) and a root domain always carries SOA and NS records.

ALIAS, ANAME and CNAME flattening are DNS host features rather than standard record types, and each host names and limits them differently. The explainers on apex domain vs CNAME and CNAME flattening cover the details. Vendors tend to steer you to a subdomain: HighLevel's help article for its login domain says to use one.

How to set up a white label domain

The steps are the same on almost every platform. Menu names differ, so take the exact target from your vendor's own instructions.

1. Pick a subdomain you do not use yet. Common choices are app, login, portal and go. Use a domain whose DNS you can edit.
2. Copy the target from the vendor. It is a hostname such as edge.vendor.example.net. Do not guess it. Vendors change targets and often use a different one for each feature.
3. Add a CNAME record. Name: the subdomain only (app, not the full name, because most DNS hosts add the domain for you). Value: the vendor's hostname. TTL: 300 seconds while you test.
4. Clear conflicts. A name that has a CNAME can hold no other record. Delete any A, AAAA, TXT or second CNAME record at the same name.
5. Turn off the proxy. If your DNS is on Cloudflare, set the record to DNS only (grey cloud) unless the vendor says otherwise. A proxied record answers with Cloudflare's addresses instead of the vendor's, so the vendor cannot prove control of the name or issue its certificate.
6. Add the domain in the vendor's settings and save. Many vendors check the record at this point and start the certificate.
7. Wait, then verify. DNS usually answers within minutes, and the certificate follows once DNS is right. Run the checks below, then open the name in a private window and on a phone.
8. Finish the branding. Upload your logo and add your terms and privacy links if the vendor asks, so no screen falls back to the vendor's.

DNS records cheat sheet

Use this table to match a goal to a record type. The values in the last column are the traps that cause most failed setups.

example.com.   3600   IN   CAA   0 issue "letsencrypt.org"

With no CAA records, any certificate authority may issue for your names. Once you publish any, the authority checks them before it issues, starting at the full name and climbing toward the root until it finds a set (RFC 8659).

Where the vendor's name still shows

The login address is only the first surface. Walk the list below as a client would and fix whatever still names the vendor.

Check a white label domain in two minutes

Run these four commands in a terminal and replace app.example.com with your name. Or paste the name into the free Domain Health Check, which tests DNS, the CNAME on a root domain, HTTPS, the certificate, its renewal runway and the redirect from http to https.

dig +short CNAME app.example.com
dig +short app.example.com
curl -sI https://app.example.com | head -n 5
echo | openssl s_client -connect app.example.com:443 -servername app.example.com 2>/dev/null | openssl x509 -noout -subject -issuer -dates

When a white label domain does not work

Most failures come from six causes. The full troubleshooting guide has the commands for each.

If you build software: white label domains for your customers

When customers bring their own domain to your product, you are the vendor in every section above. You own DNS verification, certificate issuance and renewal, routing by host, and the support tickets when a customer's record is wrong. CustomDomain™ is a managed service for that part. Your customer enters a domain and a guided flow takes over. Where their DNS provider supports it, the records are written for them; otherwise they get the exact records to copy. Ownership is verified, and the records are watched afterward for drift.

Every plan includes the embeddable widget, the SDK, the REST API, webhooks, drift detection and an MCP server. On Growth and above, traffic can run through the CustomDomain™ reverse proxy edge with automatic HTTPS. Removing CustomDomain™ branding from the connect flow and reselling domains are part of Enterprise. The white label custom domain guide shows how the pieces fit.

What a white label domain costs

Pointing a domain you already own at a vendor costs nothing at most DNS hosts, and many vendors issue the certificate for free through Let's Encrypt. The real costs sit in four places:

• The domain itself. A registration is billed yearly and the price depends on the ending. Read the renewal price, which can differ from the first-year price.
• The vendor's plan. Platforms often reserve white label domains and branding removal for higher plans. Check their pricing page before you promise it to clients.
• Engineering time, if you build custom domains into your own product. You need DNS verification, certificate issuance and renewal, and routing by host.
• Domain resale, if you sell domains. The table shows what the accreditation route costs.

Is a white label domain legal?

Yes. White labelling means selling or presenting a product under your own brand, and it is a normal, lawful way to do business. It goes wrong when it deceives or infringes:

• Misleading claims. False statements about who makes a product can count as misleading advertising, depending on the claim and the country.
• Trademarks. A domain that contains someone else's trademark can lose a dispute under ICANN's UDRP and, in the US, can create liability under the anticybersquatting law (ACPA).
• Vendor terms. Some platforms restrict resale or reserve white labelling for certain plans. The contract decides, not the technology.
• Impersonation. A domain built to pass as another company is fraud, however it is hosted.

This is general information, not legal advice. Ask a lawyer when a contract or a trademark is involved.

White label nameservers, email domains and link domains

The same idea applies to three other places a vendor's name can leak. Each uses different records.

White label nameservers

Vanity nameservers show ns1.example.com instead of the DNS host's own name. You set them at the registrar: the nameserver hostnames, plus glue records (addresses held in the parent zone) when a nameserver lives inside the domain it serves. Without glue, resolvers cannot find the nameserver and the domain stops resolving. Your DNS host must support vanity nameservers, and you must keep the addresses in step with the host's.

White label email domains

A branded sending domain makes mail show your domain instead of the platform's. The platform gives you records to add: an SPF TXT record and one or more DKIM records, often CNAME or TXT. Use a subdomain such as mail.example.com to keep the reputation of your root domain separate. An SPF record may cause at most 10 DNS lookups (RFC 7208), and past that limit it returns a permanent error.

White label link and short URL domains

A branded link domain replaces the platform's short domain in the links you send. It works like the login domain: a CNAME on a subdomain, a certificate, and a registration in the platform. Use a dedicated subdomain so a problem with link reputation does not touch your main site.