Twins ProxyDomain masking for cold email agencies
One client is a domain fleet. Ten clients is an operations problem — unless the serving side is automated.
An agency running outreach for ten clients isn't managing ten domains; it's managing ten fleets — each client's masked domains, certificates, DNS records, and landing pages, all of which must look like the client and none of which may leak the connection to anyone else's. Doing that by hand in registrar dashboards and nginx configs is how agencies end up with the intern owning production DNS.
What the fleet workflow looks like here
Onboard a client's zone once. Connect their Cloudflare (scoped API token), have them delegate one CNAME per domain, or fall back to copy-paste DNS records — whichever their IT tolerates. Write access is verified before anything depends on it.
Add domains in bulk, by API. Every dashboard action is a documented REST endpoint — create the domain, watch its provisioning state, attach it to the client's landing page, add the exact hostnames you use for links. Scripting a 20-domain client onboarding is an afternoon, once.
Certificates take care of themselves. Each domain gets an apex + wildcard certificate issued and renewed automatically — Let's Encrypt, ZeroSSL, or Google Trust Services. Nobody on your team ever babysits an expiry date.
Masked domains stay invisible to Google. Every masked domain sends a noindex header by default, so a client's twelve secondary domains never show up as twelve copies of their site in search — and never need explaining in a client call.
Swap burned domains without ceremony. A domain that's done its tour gets deleted — certificate revoked, hostname freed — and its replacement is one API call. The client's primary domain and the rest of the fleet never notice.
The economics, at agency scale
Per-domain pricing is where suite products get expensive: masking bundled into a deliverability suite runs $49–199/month for 10–120 proxy slots, with dedicated IPs at $100/month. Twins Proxy prices masking as the product: $39/month for 25 domains (Pro), +$15 per extra 10-domain pack — or the Freedom plan at $25/month, where a one-line installer turns any $20 VPS into your own serving node: your IP, your bandwidth, and no per-domain ceiling an agency will realistically hit. Dedicated static edge IPs are a $25/month add-on when a client wants their fleet on its own address.
Your infrastructure choice is also a positioning choice: on your own nodes, the IPs serving a client's domains belong to you, not to a pool shared with strangers' campaigns.
Boring on purpose
The serving layer of an outreach operation should be the boring part: verified DNS before anything routes, fail-loud provisioning states you can poll, an audit trail of who changed what, TOTP/passkey auth and scoped API keys for the team, and a public status page. It's infrastructure — it should behave like it.
Start with one fleet
The free plan puts one domain live end to end — DNS, certificate, masking, noindex — so you can validate the workflow against a real client domain before moving a fleet. New to the masking side? Start with the complete guide to masked domains or the product overview.