Custom Domains: Branded Links Build Trust

The math on this is brutal. You spent six weeks producing a campaign, strategy, brief, design, copy, QA, paid budget, and the final asset goes out the door with a bit.ly/3xK9fR2 in the headline. Every recipient sees that URL, registers "third-party redirect, unknown destination," and hovers. A quarter to 40% of them never click.

This isn't paranoia. It's calibration. Consumers have been trained by years of phishing, malware, and link-scam emails to treat unknown short links as suspicious. The same recipient who happily clicks nytimes.com/2026/05/article-headline will quietly drop a bit.ly link in the same email because there's no way to verify where it goes.

Where the lost clicks go

They don't go anywhere. They die at the hover step. Recipients hover, read the URL, fail to recognise the brand, decide it's not worth the risk, and move on. You see this in your CTR data not as a missing click but as a flat number that should have been higher.

The fix is one of the highest-ROI hours of work in any marketing stack: a custom branded domain. bit.ly/3xK9fR2 becomes go.yourcompany.com/spring-promo. Same redirect, same destination, same campaign, radically different click-through rate, because the URL itself is now an asset that communicates who is behind it before anyone clicks.

A custom branded domain replaces the generic shortener URL with one you own. Mechanically, it's a CNAME record at your DNS provider that points a subdomain of your existing domain at the shortener's redirect infrastructure. Not sure which domain to use in the first place? See how to choose a branded short domain.

The anatomy of a branded short URL

A branded short URL has three parts:

• Subdomain, the part you choose. Common patterns: go., links., l., get., my.
• Root domain, your existing brand domain (e.g., yourcompany.com)
• Slug, the per-link identifier (e.g., /spring-promo)

Combined: go.yourcompany.com/spring-promo. The recipient sees your brand before the click, the slug is human-readable, and the URL functions identically to a generic short link otherwise, same redirect, same tracking, same QR code.

Branded vs custom vs vanity, the terminology

The industry uses these interchangeably, but the practical distinction matters:

• Branded short URL = the whole URL belongs to your brand domain (the version we recommend).
• Custom slug = the path after the domain is hand-chosen (flyn.to/q2-launch vs the auto-generated flyn.to/8xK9aF). Available on every Flyn link, branded or not.
• Vanity URL = informal term, used loosely. Usually means "branded short URL with a meaningful slug".

The branded domain is the load-bearing piece. Without it, a meaningful slug still lives on flyn.to (good) or bit.ly (bad). With it, the entire URL becomes a brand asset.

The total elapsed time from "I want a branded domain" to "campaigns are live on it" is under two minutes of active work, plus DNS propagation (typically under 15 minutes, sometimes up to an hour). Here's the full process.

Step 1, Pick a subdomain

Choose a short, purposeful subdomain on a domain you already own. You don't need to buy a new domain. Most teams use:

• go.yourcompany.com, action-oriented, works for everything
• links.yourcompany.com, descriptive
• l.yourcompany.com, minimal, for character-constrained channels (Twitter, SMS)
• get.yourcompany.com, works well for marketing/conversion links
• docs.yourcompany.com, for technical content distribution

Step 2, Add the subdomain in Flyn

Settings → Domains → Add Domain. Type your chosen subdomain. Flyn returns a CNAME value to add at your DNS provider, something like cname.flyn.to.

Step 3, Add the CNAME at your DNS provider

Open your DNS dashboard (Cloudflare, Route 53, GoDaddy, Namecheap, Hover, or whatever you use). Add a single record:

• Type: CNAME
• Name / Host: go (or whatever subdomain you chose)
• Value / Target: the CNAME Flyn returned
• TTL: Auto, or 300 seconds if your provider asks

Save. That's the entire DNS setup. If you use Cloudflare, leave proxy mode OFF for first setup, proxied mode adds an extra HTTPS termination layer that complicates initial verification.

Step 4, Verify and wait for propagation

Back in Flyn, click "Verify". The dashboard polls DNS until propagation completes, usually 1-5 minutes, occasionally up to an hour for slow registrars. Once verified, Flyn auto-provisions a TLS certificate via Let's Encrypt and your branded domain serves HTTPS automatically. There's no certificate management on your end, ever.

Step 5, Set as default and start shipping

In Flyn Settings → Domains, mark your branded domain as the workspace default. New links created in the dashboard now use your branded domain by default. Existing links can be migrated in bulk via the dashboard or API.

The subdomain you pick becomes a visible piece of your brand for years. It's worth 10 minutes of deliberation upfront.

Avoid these patterns

• Long subdomains, promotions.yourcompany.com defeats the point of shortening.
• Random words, cat.yourcompany.com loses trust because recipients can't infer purpose.
• Region-coded subdomains in marketing, us.yourcompany.com makes recipients in other regions feel excluded.
• Subdomains that clash with internal systems, never use internal., admin., or app. for public-facing links.

Multi-brand and multi-purpose patterns

Companies with multiple brands or departments often want separate domains. Flyn Pro supports up to 3 custom domains per workspace, all managed from one dashboard. Common splits:

• go.brand-a.com + go.brand-b.com for multi-brand portfolios
• links.yourcompany.com (marketing) + docs.yourcompany.com (technical) + get.yourcompany.com (sales)
• Region-specific marketing where regulatory differences justify it: go.yourcompany.com (global) + go.yourcompany.eu (GDPR-region-specific)

For organisations needing more than 3 domains, enterprise plans support unlimited custom domains with per-domain analytics dashboards. Check pricing for details.

After switching to branded links, monitor CTR across channels for 4-8 weeks before reading the numbers, the lift compounds as your audience gets repeatedly exposed to the new domain and learns to trust it.

The teams seeing the largest CTR gains from branded domains aren't doing anything clever with them. They just made every link they ship, every email, every social post, every QR, use the same branded short URL, and let consistency do the work over time.

Measuring the lift on your own campaigns

Don't compare lifetime averages, compare matched campaigns. Run the same email sequence to a held-out cohort with generic links and the main cohort with branded links, hold everything else constant, measure CTR over 14 days. The difference is your lift. A/B testing short links at the redirect layer isolates this cleanly.

Why the lift is durable, not one-time

Generic-link fatigue compounds. Every phishing attempt that uses bit.ly erodes trust in legitimate bit.ly links. The 2026 baseline is worse than the 2024 baseline. A branded domain insulates your brand from that trend, and the relative lift grows year over year. Migrating from a generic shortener now? Our Bitly migration guide covers the cutover.

Branded short domains are not just for external marketing. The biggest non-obvious wins come from internal teams whose links currently look unprofessional or inconsistent.

Engineering and DevOps

Deploy preview URLs shared in Slack, internal tool links, runbook references. go.yourcompany.com/staging beats https://acme-frontend-pr-3492-preview.vercel.app for readability and persistence. Engineers update the destination as deploys move; the short link stays stable.

HR and people operations

Benefits portal links, policy documents, onboarding resources, performance review tools. Every email an HR team sends contains 3-8 links. Branded short URLs make the entire HR communication stack feel intentional rather than ad-hoc.

Sales and customer success

Proposal links, demo recordings, case study references, pricing pages. A sales rep sending a prospect go.yourcompany.com/proposal-acme looks orders-of-magnitude more credible than a 200-character DocSend URL. Track which prospects actually click which proposal sections.

Support and customer education

Knowledge base articles, video tutorials, status pages. A branded short URL in a support response feels like the team has invested in their tooling. The same content behind a bit.ly feels improvised.

Internal communications

All-hands recordings, company wiki pages, OKR documents. go.yourcompany.com/q2-okrs as a permanent reference that the underlying doc can move behind.

Branded domains are inseparable from HTTPS in 2026. Browsers actively warn on HTTP links; email clients downrank them; some messaging platforms refuse to preview them. Flyn handles the SSL lifecycle automatically, but the security posture deserves explanation.

How TLS certificates are provisioned

Flyn provisions TLS certificates via Let's Encrypt at the moment your CNAME verifies. The cert renews automatically every 60 days (Let's Encrypt issues 90-day certs; renewal happens at 60 days for safety margin). You never manage cert lifecycle. There is no separate SSL line item, no surcharge, no manual upload.

What the cert protects

The certificate encrypts the redirect traffic between the user's device and Flyn's edge network. Once Flyn redirects them to your destination URL, that destination's TLS configuration takes over. Make sure your destination URLs are also HTTPS, a branded short URL that redirects to an HTTP destination produces a mixed-content warning in most browsers.

HSTS and modern security headers

Branded domains on Flyn ship with HSTS (HTTP Strict Transport Security), preventing downgrade attacks. Use the free security headers checker on your branded domain to verify the full security configuration after setup.

GDPR and audit logging

Flyn logs IP-derived geolocation (not raw IP) on every redirect for analytics. Enterprise plans include configurable retention windows for compliance with GDPR's data minimisation requirements. Branded domains don't change this baseline, but they do mean your redirect traffic flows through your brand's privacy policy, not a third party's, which simplifies compliance disclosures.

For the half of teams where DNS is mysterious and the half where it's day-job-obvious, here's the technical detail of what's actually happening, and the common configuration mistakes that delay launches.

What the CNAME record does

A CNAME record tells the DNS system "for this subdomain, look up the IP address of this other hostname." When someone requests go.yourcompany.com, their resolver follows the CNAME to cname.flyn.to, which resolves to Flyn's edge servers. The user's browser then connects directly to Flyn's infrastructure, presents the host header go.yourcompany.com, and Flyn responds with the redirect to your destination.

Why a CNAME, not an A record

An A record points a hostname to a specific IP address. Flyn's edge network changes IPs as the infrastructure scales, a CNAME insulates you from those changes. If you're forced to use an A record (some root-domain providers don't support CNAMEs for subdomains), use a static-IP enterprise configuration via the Flyn team.

Propagation timeline

Most DNS providers propagate CNAME changes within 1-5 minutes. Cloudflare and AWS Route 53 propagate in under 60 seconds. Slow legacy providers (some older GoDaddy / Bluehost configurations) can take 1-4 hours. Global propagation completes within 24 hours, but typically full functionality is available within the first hour.

Common configuration mistakes

• Trailing dots, some DNS providers require cname.flyn.to. (with trailing dot), others reject the dot. Flyn's dashboard shows what your specific provider expects.
• Conflicting records, if you already have an A or AAAA record for the same subdomain, the CNAME will fail. Delete the conflicting records first.
• Cloudflare proxy mode with SSL set to "Flexible", causes redirect loops. Use "Full (strict)" or disable proxy mode.
• CAA records blocking Let's Encrypt, if your domain has CAA records, add letsencrypt.org as an authorised CA, or remove the CAA restriction.

The Flyn dashboard's domain settings page polls DNS resolution status in real time, so you can confirm propagation is complete before relying on the domain for campaigns. If a setup is stuck, the dashboard surfaces the exact configuration mismatch. The trust a branded domain buys is decisive in SMS marketing, where carriers filter unbranded links as spam.