Twins ProxyDomain masking vs domain forwarding for cold email
Both put a website behind your secondary domains. Only one keeps your primary domain out of it.
If you send cold email from secondary domains — yourbrand-hq.com,
getyourbrand.com — those domains need to resolve to something. A prospect who
types the domain into a browser, and every spam filter that follows the links in your message,
should find a real website. There are two ways to provide one, and they are not equivalent.
Domain forwarding: a redirect
Forwarding answers any request to the secondary domain with an HTTP 301 or 302
redirect to your primary site. The browser follows it; the address bar changes to
yourbrand.com; your primary site serves the page. Every registrar offers this for
free, which is why it's the default choice — and the default mistake.
Domain masking: a reverse proxy
Masking answers the request directly, under the secondary domain's own
hostname. A reverse proxy fetches your primary site's content and serves it as
yourbrand-hq.com, with a valid certificate for that exact name. The address bar
never changes. Your primary domain appears nowhere in the exchange — not in a Location header,
not in the certificate, not in DNS.
Side by side
| Forwarding (301/302) | Masking (reverse proxy) | |
|---|---|---|
| Address bar after click | Changes to your primary domain | Stays on the secondary domain |
| What a link-following spam filter sees | The redirect — and your primary domain behind every secondary | An ordinary website on the secondary domain |
| Ties your domains together publicly | Yes — one HTTP request reveals the mapping | No |
| Spoofing-style alerts on the primary | Possible when many domains funnel into one site | No funnel exists to flag |
| HTTPS on the secondary domain | Often skipped or half-configured | Wildcard certificate per domain, automatic |
| Primary site's spam-complaint blast radius | Shared — the primary absorbs the association | Contained to the secondary domain |
| Cost | Free at the registrar | A masking service or self-hosted proxy |
Why the difference matters to deliverability
Secondary domains exist to isolate risk: if one gets burned, your primary — and the rest of your fleet — should be untouched. A redirect quietly breaks that isolation. Corporate mail gateways resolve the URLs in inbound mail as a matter of course; a 301 hands them the complete map from every secondary domain to the one primary behind them. At that point the domains are separate on paper and connected in every filter's graph.
Masking preserves the isolation the secondary domains were bought for. Each one is, as far as any observer can tell, an independent site with its own certificate serving its own content.
When forwarding is fine
Honesty first: not every situation needs masking. A redirect is perfectly reasonable when the secondary domain is defensive (a typo domain, an alternate TLD you own so nobody else does) and is never used for outreach — there's no sending reputation to protect and no reason to hide the association. It's outreach domains, where the whole point is separation from the primary, where a redirect defeats the purpose.
What about SEO and duplicate content?
Masked domains serve copies of your primary content, so they must stay out of search
indexes — they exist for the links in your email, not for ranking. Twins Proxy handles this by
default: masked domains send X-Robots-Tag: noindex, nofollow on every response,
leaving your primary domain the only indexed copy (with a per-domain toggle if you ever want
one indexed). With forwarding, a 301 passes signals to the primary — precisely the public
linkage you were trying to avoid.
Setting up masking with Twins Proxy
Connect a DNS provider (or delegate one CNAME, or paste TXT records by hand), add your secondary domains, and point them at your landing pages. Twins Proxy verifies DNS, issues a wildcard certificate per domain, and serves your content under every hostname you route — here's the full picture, and the free plan covers your first domain end to end.