Configure your white-label domain
Point your domain at your Tenant instance, let Mally provision SSL automatically, and set up a separate sending domain for AWS SES.
Two separate domains
A Mally Tenant deployment uses two different domains for two different purposes:
- Platform domain: The URL where clients log in to use the platform — e.g. send.youragency.com. This is where the web application lives.
- Sending domain: The domain used in From addresses when sending emails — e.g. mail.youragency.com. This is what goes through AWS SES and needs its own DKIM and verification records.
They can be on the same root domain (both on youragency.com) or completely separate. Using the same root domain (e.g. app.youragency.com for the platform and mail.youragency.com for sending) is the most common setup.
DNS records to add
Mally will provide you with the exact records and values to add. The general structure is:
| Type | Name | Value | Purpose |
|---|---|---|---|
A | send (or your subdomain) | Your server IP | Platform URL |
CNAME | www.send (optional) | send.youragency.com | www redirect |
If you use Cloudflare, make sure the A record is proxied (orange cloud) for best performance — this routes traffic through Cloudflare's CDN. If you are using a different provider, set the TTL to 300 seconds for faster propagation.
Check propagation
After adding records, you can check propagation at dnschecker.org or by running dig send.youragency.com in a terminal.
SSL certificate
Mally automatically provisions a free SSL certificate from Let's Encrypt once your DNS records propagate to the server. No action is required from you.
The certificate is provisioned by Certbot running on your server. It auto-renews every 90 days — Mally handles this as part of the managed service. You will never need to manually renew an SSL certificate.
The certificate covers your platform domain and the www subdomain (if configured). If you add additional subdomains later, a new certificate issuance may be needed — contact Mally support if this applies.
Setting the domain in Platform Settings
After DNS is live, confirm the domain in your platform settings. Go to Console → Settings → Platform → Platform URL and ensure it matches your configured domain exactly — including the scheme:
https://send.youragency.com
This URL is used in outbound system emails (welcome emails, password resets) as the base for all links. Getting this wrong results in broken links in emails sent by the platform.
Sending domain for SES
Your sending domain (the domain used in From addresses) has a separate set of DNS records. These go through AWS SES verification and DKIM, not the platform server.
A common convention is to use mail.youragency.com as the sending domain — it keeps the platform URL and email sending clearly separated. Your clients' From addresses would then be something like hello@mail.youragency.com.
To set this up, follow the steps in the Connect AWS SES guide — specifically the domain verification section. You will add three DKIM CNAME records for the sending domain in addition to the platform A record.
Clients can use your agency sending domain (e.g. mail.youragency.com) or verify and use their own domain. Client-specific sending domains give clients full brand control and reputation isolation.
Testing with curl
Once DNS has propagated, verify your platform is reachable over HTTPS:
curl -I https://send.youragency.com
You should see a response like:
HTTP/2 200 server: nginx content-type: text/html; charset=utf-8 ...
An HTTP/2 200 response confirms the domain is resolving, SSL is working, and the application is responding. If you see a certificate error, DNS may not have fully propagated yet — wait 10–15 minutes and try again.
You can also simply visit the URL in a browser — you should see the Mally login page styled with your brand name and logo.