My Domain
My Domain is the Salesforce feature that gives each org its own branded subdomain (acme.my.salesforce.com instead of na123.salesforce.com). It became a mandatory feature for every Salesforce org in…
Definition
My Domain is the Salesforce feature that gives each org its own branded subdomain (acme.my.salesforce.com instead of na123.salesforce.com). It became a mandatory feature for every Salesforce org in 2022; orgs without My Domain configured have one auto-assigned by Salesforce during the rollout. My Domain is foundational to single sign-on, Lightning Web Components security, Lightning Components from packages, and most modern Salesforce identity features that require a stable subdomain.
Beyond branding, My Domain enables capabilities that depend on a predictable URL. SSO providers (Okta, Azure AD, Google Workspace) require a My Domain to configure SAML or OAuth flows. Lightning Web Components and Aura components served by Lightning Locker use the My Domain as their security origin. Mobile apps and integrations that need to deep-link into Salesforce records use the My Domain URL pattern. Activating My Domain takes about 24 hours from request to live, and the activation is the kind of change that disrupts every active session in the org.
Why My Domain matters and what it unlocks beyond a branded URL
The mandatory rollout and pre-2022 orgs
Until 2022, My Domain was opt-in. Many orgs lived on the default URL pattern (na123.salesforce.com, eu5.salesforce.com) for years without issue. Salesforce mandated My Domain in the Spring 2022 release; orgs that had not configured one received an auto-assigned subdomain at activation. The mandate was driven by security improvements: Lightning Locker, modern CSP, and SSO patterns all assume a stable per-org subdomain. Orgs that have not consciously named their domain often have a generic auto-name they would have picked differently.
The URL pattern and login flow
After My Domain activation, the org URL becomes acme.my.salesforce.com (or acme.lightning.force.com for the Lightning UI). Users can still log in via login.salesforce.com but get redirected to the My Domain URL after authentication. The My Domain URL appears in every page link, email notification, and API endpoint reference. Bookmarks built before activation may continue working through redirect, but new bookmarks all use the My Domain pattern. Email notifications also link to the My Domain.
SSO and identity provider integration
Single sign-on configurations almost universally require My Domain. SAML providers register the Salesforce SP using the My Domain as the entityID and ACS URL. OAuth providers register the My Domain as the redirect URI. Switching from one IDP to another or changing My Domain itself requires reconfiguring the SP on the IDP side. Most enterprise rollouts get My Domain right on day one because SSO depends on it; greenfield orgs sometimes miss this and have to redo SSO config.
Lightning Components and the security origin
Lightning Web Components and Aura components served by Lightning Locker enforce same-origin policies based on the My Domain. Cross-origin issues (an LWC trying to call an external URL, or vice versa) require explicit CORS allowlisting on the Setup, CORS page, configured for the My Domain. Without My Domain (impossible after 2022 but historically true), the security model could not enforce origin checks properly. This is why Salesforce mandated My Domain for Lightning ecosystem features.
Activation sequence and the 24-hour propagation
Activating My Domain has two phases. Test phase: the new URL works alongside the old; admins verify that bookmarks, SSO, and integrations still function. Deployment phase: the new URL becomes the only login URL; the old URL redirects. Between request and deployment, DNS records propagate (about 24 hours). After deployment, every active session is invalidated and users must log in again via the new URL. Communicate the deployment timing to users; surprise re-logins generate support tickets.
Custom Domain and the next tier of branding
Beyond My Domain, Salesforce offers Custom Domain (sometimes called Custom URL or Enhanced Domains): users access Salesforce via app.acme.com instead of acme.my.salesforce.com. This requires the org to own the domain, configure DNS records, and either upload an SSL cert or use Salesforce-provisioned certs. Custom Domain is one tier above My Domain on the branding ladder, mostly used by enterprises whose internal users perceive Salesforce as a third-party product they want to disguise as a first-party app.
Implications for hardcoded URLs and integrations
Integrations and Apex code that hardcoded the old na123.salesforce.com pattern break after My Domain activation. The fix is referencing the org URL dynamically via System.URL.getOrgDomainUrl() in Apex or via the user.organization_id metadata in external integrations. Audit Apex callouts, REST integrations, and any external system that contains a Salesforce URL constant. The migration is mostly mechanical but easy to miss in a large code base.
Configuring and activating My Domain
My Domain setup has four phases: request the name, test in parallel, deploy live, and audit for impacts. Plan a release cycle from request to live, with active communication to users and integration owners.
- Pick the My Domain name
Setup, Company Settings, My Domain. Enter the desired subdomain (acme, acme-prod, brandname). Salesforce checks availability; names are first-come-first-served across the platform. Avoid names that conflict with trademarks or other brands.
- Request and wait for DNS propagation
After submission, Salesforce provisions DNS records. Propagation takes up to 24 hours. During this window the new URL works for testing but the old URL is still primary. Verify the new URL resolves and the test login page loads.
- Test in parallel
Log in via the new URL. Verify SSO, integrations, Lightning Web Components, and external links work. Test as multiple user profiles. Document any breakages and fix before deployment.
- Deploy My Domain live
Setup, My Domain, Deploy to Users. The new URL becomes primary; old URLs redirect. Every active session is invalidated; users must log in again. Communicate the timing to users 24-48 hours ahead.
- Audit for hardcoded URLs
Apex code, Visualforce pages, integrations, email templates. Find any hardcoded references to the old na123 or eu5 pattern. Replace with dynamic URL retrieval via System.URL.getOrgDomainUrl() or external configuration.
The branded part of acme.my.salesforce.com. First-come-first-served across the platform; cannot be changed after activation without a deployment.
Some orgs see acme.lightning.force.com for the Lightning UI alongside acme.my.salesforce.com for Classic-pattern URLs. Both resolve to the same org.
Beyond My Domain, configure a customer-owned domain (app.acme.com) for higher-tier branding.
Salesforce''s newer URL pattern that consolidates several legacy subdomains. Auto-applied to most orgs; check Setup, Enhanced Domains for status.
- Deployment invalidates every active session. Communicate timing to users 24-48 hours ahead to avoid support ticket surge.
- SSO providers need reconfiguration when My Domain changes. Coordinate with the IDP team; SAML and OAuth registrations all reference the My Domain URL.
- Hardcoded URLs in Apex, Visualforce, and integrations break after activation. Audit thoroughly; use dynamic URL retrieval methods.
- Subdomain names are first-come-first-served and cannot be changed easily. Pick carefully on initial request.
- The Custom Domain upgrade requires DNS ownership and certificate management. More setup work than My Domain alone.
Trust & references
Cross-checked against the following references.
- My Domain OverviewSalesforce Help
- Set Up My DomainSalesforce Help
Straight from the source - Salesforce's reference material on My Domain.
- Deploy My Domain to UsersSalesforce Help
- Enhanced Domains OverviewSalesforce Help
About the Author
Dipojjal Chakrabarti is a B2C Solution Architect with 29 Salesforce certifications and over 13 years in the Salesforce ecosystem. He runs salesforcedictionary.com to help admins, developers, architects, and cert/interview candidates sharpen their fundamentals. More about Dipojjal.
Test your knowledge
Q1. What is the primary benefit of My Domain for Salesforce administrators?
Q2. Why is understanding My Domain important for Salesforce admins?
Q3. Can a Salesforce admin configure My Domain without writing code?
Discussion
Loading discussion…