---
title: "My Domain and enhanced domains"
url: "https://trailassembly.com/my-domain-and-enhanced-domains/"
topic: "Admin and Permissions"
published: "2026-09-16T04:49:14+00:00"
updated: "2026-10-06T13:56:17+00:00"
---

# My Domain and enhanced domains

**My Domain gives your org its own hostname, and enhanced domains removed the instance name from every Salesforce URL your users and integrations touch.** The work is done for most orgs now. What remains is the consequence: any hostname you hard-coded, allowlisted or stored somewhere is either already updated or already broken, and renaming a My Domain afterwards is a project rather than a setting change.

## What the URLs look like now

Enhanced domains produce a consistent, instance-free format. The pattern matters more than the examples:

```apex
Login and app      https://mycompany.my.salesforce.com
Sandbox            https://mycompany--uat.sandbox.my.salesforce.com
Experience Cloud   https://mycompany.my.site.com/customers
Visualforce        https://mycompany--namespace.vf.force.com
Sandbox VF         https://mycompany--uat--namespace.sandbox.vf.force.com
```

The double hyphen is the separator that trips up parsers. A sandbox [Visualforce](https://trailassembly.com/apex-visualforce-remoting/) host has two of them, and any [regular expression](https://trailassembly.com/regex-too-complicated/) written against the old instance-based format will fail on it.

What disappeared was the instance identifier, the `na` or `cs` fragment that used to appear in the hostname. That is the change worth understanding, because the instance was never stable. Salesforce moves orgs between instances, and every system that stored an instance-based URL was holding a value that could change without notice. Enhanced domains made the hostname belong to the org instead.

## Who it actually affected

Not end users, mostly. Browsers follow redirects and people re-bookmark. The pain landed elsewhere:

- **Firewall and proxy allowlists.** Network teams who allowed specific hostnames rather than the wildcard domains had to update them, and this is the failure that looks like Salesforce being down.

- **SAML configuration.** Entity ID and ACS URL both contain the hostname. An identity provider configured against the old format stops authenticating.

- **Connected app callback URLs.** Same problem, different screen. A redirect URI that no longer matches produces an [OAuth](https://trailassembly.com/salesforce-oauth-flows-compared/) error that names nothing useful.

- **CORS allowlists and CSP trusted sites.** Both are hostname lists inside Salesforce itself, and both need the new format.

- **Integrations storing an instance URL.** A client that saved `instance_url` once at setup time, rather than reading it from each token response, is holding a stale value.

- **Email templates and Knowledge articles** with hard-coded links, which fail quietly because nobody clicks them in testing.

## Stop hard-coding the hostname

In Apex, ask the platform:

```apex
String base = Url.getOrgDomainUrl().toExternalForm();
String recordLink = base + '/' + acc.Id;
```

That returns the correct value in every environment, including a freshly refreshed sandbox, with no configuration. Anything that concatenates a literal domain into a string is a bug waiting for the next refresh.

In an external integration, read `instance_url` from the OAuth token response on every authentication and use it for that session. It is returned for a reason. Storing it in a config file and forgetting is how integrations break during a migration nobody told you about.

## The settings on the My Domain page worth knowing

Two policies do real work. The login policy can prevent users reaching your org through the generic Salesforce login page, which forces everyone through your domain and therefore through your SSO and login IP rules. Turn it on once SSO is proven, not before.

The redirect policy controls what happens to old links. The options range from redirecting silently, to redirecting with a warning page, to not redirecting at all. Tightening it is the right end state and it is also what finally breaks the last few hard-coded links, so tighten it deliberately rather than on a quiet Friday.

## Renaming a My Domain

You can. Treat it as a migration with a change window, because everything in the list above changes at once: SSO, callback URLs, allowlists, Experience Cloud URLs, links in emails already sent, and every bookmark in the company. Salesforce provides a redirect from the previous name for a limited period, which buys you time rather than solving the problem.

Pick a name you can live with and never touch it again. A rebrand is the usual reason people have to, and even then, weigh the cost against living with the old name in a URL.

## Frequently asked

**Do sandboxes inherit the production My Domain?** The sandbox gets a derived hostname containing the sandbox name, so it differs from production. Anything configured with the production host needs a sandbox equivalent.

**Can I use a custom domain like crm.mycompany.com?** Yes, through the Domains setup with your own certificate, most commonly for Experience Cloud sites. The underlying `my.salesforce.com` host still exists behind it.

**What breaks if I do nothing?** For most orgs, nothing, because enhanced domains are already in place. The remaining risk sits in external systems holding old hostnames, and Login History will show you which ones still authenticate.

---

Source: https://trailassembly.com/my-domain-and-enhanced-domains/
Trail Assembly — independent Salesforce write-ups.