Velocity X customers can expose their booking, admin, or lead-intake surfaces on any subdomain they control — book.yourbusiness.com, portal.yourbusiness.com, even quotes.yourbusiness.com — and each one maps to a white-label instance of Velocity X without a separate deployment. The user sees only their brand. No "Powered by Velocity X" footer. No third-party chrome. Technically, the magic is a single wildcard SSL certificate, a CNAME pointing subdomains to the Velocity X origin, and a Host header lookup that says: "Oh, you hit book.acme.com? Load the ACME tenant dashboard".
Why Subdomains Beat Paths for White-Label
You could use path-based routing — velocity.com/acme/portal — but then every customer's app lives under the Velocity domain. Subdomains let each customer own the Host header. They can set up their own CNAME, point it to Velocity's origin, and feel like they own the infrastructure. Psychologically, book.acme.com feels more premium and trustworthy than a third-party path. From an SSL perspective, one wildcard cert on *.yourbusiness.com covers unlimited subdomains without per-customer cert management.
The Architecture — Host Header Lookup
On every request, Velocity X reads the Host header. If it's book.acme.com, the system parses acme, queries the tenant table for that subdomain, and loads ACME's config (branding, permissions, feature flags). The same Velocity X origin serves every customer. No forking, no separate builds. The rendering layer is tenant-agnostic — it pulls styles from brand.json at request time.
DNS Setup: CNAME and Wildcard
Each customer adds a single CNAME record in their DNS: book CNAME velocity-api.netlify.app (or your origin). Velocity's Netlify account holds one wildcard SSL certificate covering *.acme.com, so the connection is encrypted from day one. No customer action on SSL — no CSR, no cert provisioning. The wildcard cert is managed by Netlify; renewal is automatic.
If a customer uses Netlify too, they can add the CNAME to their Netlify site config directly. If they're on another host (GoDaddy, Route53, etc.), they add the CNAME in their DNS provider's UI — a 30-second job. Once the CNAME propagates (usually <5 min), book.acme.com routes to Velocity's origin, and the Host header trigger fires.
Frequently Asked Questions
Can customers use apex domains (acme.com, not book.acme.com)?
Technically no — apex domains need A/AAAA records, not CNAMEs, due to DNS spec. However, most customers use descriptive subdomains anyway (book, portal, schedule) because they make the intent clear. If a customer insists on apex, you can use CNAME flattening (offered by DNS providers like Cloudflare, Route53) which converts the CNAME to A records transparently.
What happens if two customers map the same subdomain?
DNS will route them to Velocity's origin, but the Host header lookup will find only one tenant record. If it's a collision, the system surfaces an error or falls back to a default tenant. In practice: enforce subdomain uniqueness in your onboarding — it's a cheap database constraint and prevents confusion.
How do you keep wildcard SSL in sync with customer domains?
The wildcard certificate is issued for a single domain — e.g. *.acme.com — and covers only subdomains of acme.com. Each customer must manage their own wildcard cert for their own domain. Velocity holds the origin cert; customers' subdomains are validated via the CNAME. It's a two-certificate system: one for Velocity, one per customer per domain.
Does this work for multi-tenant SaaS?
Yes. Velocity X uses the Host header to identify the tenant, then applies RLS (Row-Level Security) on the database side. A booking made on book.acme.com is stored in the acme tenant's schema. A booking made on book.globex.com goes to globex. Same origin, isolated data.
Can you use subdomains for API endpoints too?
Absolutely. api.acme.com can point to the same origin as book.acme.com; the router parses the path and Host header to determine whether it's a booking UI request or an API request. Both get the same tenant context.
What if a customer's domain expires or they cancel?
Their CNAME becomes invalid, and requests to their subdomain fail with a DNS error. You can optionally add a catch-all redirect in Velocity that surfaces a "this tenant is inactive" page, or let it fail silently. Either way, Velocity's origin stays up; only that customer's traffic is affected.
The Bottom Line
Subdomains + CNAME + wildcard SSL let you ship a white-label multi-tenant SaaS without per-customer deployments, cert management, or infrastructure overhead. One origin, one codebase, infinite branded surfaces. It's the standard pattern for Zapier, Stripe, and every SaaS that powers other businesses — and Velocity X makes it as simple as reading a Host header.