By default, the images promoted to your [asset library](/edge/asset-library) are served from a generic CloudFront domain (e.g. `d111111abcdef8.cloudfront.net`). A **custom image domain** lets you front that distribution with a branded subdomain you control, such as `cdn.yourdomain.com`, so image URLs match your brand.

SendOps requests and attaches the TLS certificate for the subdomain on your Edge assets distribution — you only need to add the DNS records.


  Custom image domains attach to your [Edge stack's](/edge/edge-stack) assets distribution, so the Edge stack must be **active** before you can add one. They're managed from the Edge area of the dashboard.


## Adding a custom image domain

On the **Edge Stack** page (active state), find the **Custom image domain** section.




  <Step title="Enter your subdomain">
    Click **Add custom domain**, enter a dedicated subdomain such as `cdn.yourdomain.com`, and submit. SendOps requests an SSL certificate for it and begins provisioning.
  </Step>

  <Step title="Add the certificate validation record">
    While the certificate is **pending**, SendOps shows an ACM validation **CNAME** record. Add it at your DNS provider. AWS issues the certificate automatically once it detects this record.
  </Step>

  <Step title="Point the subdomain at the distribution">
    Add a **CNAME** record pointing your subdomain at the Edge assets distribution domain (shown on the page). This is what makes `cdn.yourdomain.com` resolve to your CDN.
  </Step>


Each DNS value has a copy button to avoid transcription errors.

## Status

The domain card shows the certificate state:

| Status | Meaning |
|--------|---------|
| **Pending** | The certificate has been requested. Add the validation record; issuance completes automatically once AWS detects it. |
| **Issued** | The certificate is issued and attached to your distribution. |
| **Failed** | The certificate request failed or timed out. Remove the domain and add it again to retry. |

## Removing a custom image domain

Use the remove (trash) action on the domain. This **detaches** the subdomain from your CloudFront distribution and **deletes its certificate**. You can add it again later.


  Adding a custom image domain currently provisions the subdomain and certificate on your distribution, but template image URLs are **not yet rewritten** to use it — promoted images continue to resolve to the default assets domain. The custom domain is ready to serve, and automatic URL rewriting is planned as a follow-up.


## Permissions

Custom image domains use the same permissions as the rest of the Edge stack: `aws.edge.view` to see them, `aws.edge.manage` to add or remove them.

## What's next?

- [Edge Stack](/edge/edge-stack) — enable and manage the underlying CDN.
- [Asset Library & Images](/edge/asset-library) — how template images get promoted to the CDN.
- [Tracking Domains](/domains/tracking-domains) — brand your open/click tracking links too.