---
title: "Custom webmail domain"
description: "Your team opens its mail at a subdomain of yours, such as mailbox.yourcompany.com, with your brand on it."
url: "https://nextmail.sh/docs/knowledge/addresses/webmail-domain"
area: "Knowledge base"
category: "Domains & addresses"
status: "live"
---

# Custom webmail domain

Your team opens its mail at a subdomain of yours, such as mailbox.yourcompany.com, with your brand on it.

## Details

- Any workspace on a paid plan can open the web app on a subdomain of its own, such as mailbox.yourcompany.com, on one of its verified domains or any other domain it controls. It is set on the Branded app tab of Settings → Customisations, or through the API, the SDK, the CLI or the MCP server. A workspace has one.
- Setting it up shows one CNAME record that points the name at cname.openemail.uk. A name on a domain that is not in the workspace also shows a TXT record that proves the domain is yours, and nothing is set up until that record answers. Add them at your DNS provider, or press Sync on a domain whose DNS you connected and the CNAME is written for you. The HTTPS certificate for the name is issued and renewed automatically.
- It switches on once its records answer and the certificate is issued, and the status then reads Live. The tab checks on its own while it is open, and Check now asks straight away.
- Only people who belong to the workspace sign in there: its members, the people who sign in with one of its addresses, and anyone with a pending invitation, who can also create their account there. Anyone else gets the usual wrong email or password answer.
- Once the workspace has a logo, it takes the place of ours on the sign-in pages and in the app, and the browser tab and the installed app icon carry the workspace’s name and mark. Without a logo, the sign-in pages look like ours. The emails Nextmail sends your people, such as invitations and password resets, link back to your address and, with a logo, carry it too. Mail your team sends no longer carries the Sent via Nextmail line.
- The mail itself does not move. Addresses, domains and their DNS records stay as they are, nextmail.sh keeps working for the same people, and search engines are asked to leave the address alone.
- On the free plan the address is paused, not deleted. Nobody can sign in there, emails link to nextmail.sh again, and it comes back as soon as the workspace is on a paid plan again.
- People sign in there with their email and password, and two-factor when they have turned it on. There is no single sign-on.