Not verified hands-on. This article was written from primary documentation rather than reproduced in an org, so it carries no tested-release badge. If you run it and something differs, say so in the comments and it gets tested and corrected.

My Domain gives your org its own hostname, and enhanced domains removed the instance name from every Salesforce URL your users and integrations touch. The work is done for most orgs now. What remains is the consequence: any hostname you hard-coded, allowlisted or stored somewhere is either already updated or already broken, and renaming a My Domain afterwards is a project rather than a setting change.

What the URLs look like now

Enhanced domains produce a consistent, instance-free format. The pattern matters more than the examples:

Login and app      https://mycompany.my.salesforce.com
Sandbox            https://mycompany--uat.sandbox.my.salesforce.com
Experience Cloud   https://mycompany.my.site.com/customers
Visualforce        https://mycompany--namespace.vf.force.com
Sandbox VF         https://mycompany--uat--namespace.sandbox.vf.force.com

The double hyphen is the separator that trips up parsers. A sandbox Visualforce host has two of them, and any regular expression written against the old instance-based format will fail on it.

What disappeared was the instance identifier, the na or cs fragment that used to appear in the hostname. That is the change worth understanding, because the instance was never stable. Salesforce moves orgs between instances, and every system that stored an instance-based URL was holding a value that could change without notice. Enhanced domains made the hostname belong to the org instead.

Who it actually affected

Not end users, mostly. Browsers follow redirects and people re-bookmark. The pain landed elsewhere:

  • Firewall and proxy allowlists. Network teams who allowed specific hostnames rather than the wildcard domains had to update them, and this is the failure that looks like Salesforce being down.
  • SAML configuration. Entity ID and ACS URL both contain the hostname. An identity provider configured against the old format stops authenticating.
  • Connected app callback URLs. Same problem, different screen. A redirect URI that no longer matches produces an OAuth error that names nothing useful.
  • CORS allowlists and CSP trusted sites. Both are hostname lists inside Salesforce itself, and both need the new format.
  • Integrations storing an instance URL. A client that saved instance_url once at setup time, rather than reading it from each token response, is holding a stale value.
  • Email templates and Knowledge articles with hard-coded links, which fail quietly because nobody clicks them in testing.

Stop hard-coding the hostname

In Apex, ask the platform:

String base = Url.getOrgDomainUrl().toExternalForm();
String recordLink = base + '/' + acc.Id;

That returns the correct value in every environment, including a freshly refreshed sandbox, with no configuration. Anything that concatenates a literal domain into a string is a bug waiting for the next refresh.

In an external integration, read instance_url from the OAuth token response on every authentication and use it for that session. It is returned for a reason. Storing it in a config file and forgetting is how integrations break during a migration nobody told you about.

The settings on the My Domain page worth knowing

Two policies do real work. The login policy can prevent users reaching your org through the generic Salesforce login page, which forces everyone through your domain and therefore through your SSO and login IP rules. Turn it on once SSO is proven, not before.

The redirect policy controls what happens to old links. The options range from redirecting silently, to redirecting with a warning page, to not redirecting at all. Tightening it is the right end state and it is also what finally breaks the last few hard-coded links, so tighten it deliberately rather than on a quiet Friday.

Renaming a My Domain

You can. Treat it as a migration with a change window, because everything in the list above changes at once: SSO, callback URLs, allowlists, Experience Cloud URLs, links in emails already sent, and every bookmark in the company. Salesforce provides a redirect from the previous name for a limited period, which buys you time rather than solving the problem.

Pick a name you can live with and never touch it again. A rebrand is the usual reason people have to, and even then, weigh the cost against living with the old name in a URL.

Frequently asked

Do sandboxes inherit the production My Domain? The sandbox gets a derived hostname containing the sandbox name, so it differs from production. Anything configured with the production host needs a sandbox equivalent.

Can I use a custom domain like crm.mycompany.com? Yes, through the Domains setup with your own certificate, most commonly for Experience Cloud sites. The underlying my.salesforce.com host still exists behind it.

What breaks if I do nothing? For most orgs, nothing, because enhanced domains are already in place. The remaining risk sits in external systems holding old hostnames, and Login History will show you which ones still authenticate.