diff --git a/cloudhub-2/modules/ROOT/pages/ps-config-domains.adoc b/cloudhub-2/modules/ROOT/pages/ps-config-domains.adoc
index 76b4209b..fb09040b 100644
--- a/cloudhub-2/modules/ROOT/pages/ps-config-domains.adoc
+++ b/cloudhub-2/modules/ROOT/pages/ps-config-domains.adoc
@@ -9,6 +9,16 @@ Each private space includes one TLS context by default (for traffic to `cloudhub
 The default certificate renews automatically and requires no action from the user.
 You can create additional TLS contexts as required.
 
+[NOTE]
+====
+The `cloudhub.io` parent domain is shared across all customers, control planes, and regions.
+Because private spaces from different customers resolve under this same parent domain, browsers treat them as the same site. As a result, cookies set at the `cloudhub.io` scope aren't isolated between customers.
+
+The domain format varies by control plane. For example, applications on the US control plane use `*.<space-id>.<region>.cloudhub.io`, while applications on other control planes add a control-plane suffix, such as `*.<space-id>.<region>.eu1.cloudhub.io`. For more information, see xref:ch2-deploy-private-space.adoc[].
+
+Hosting websites or other browser-facing applications isn't supported for the default `cloudhub.io` domain. To keep browser-facing applications isolated, deploy them to a customer-owned vanity domain by configuring a TLS context with your own domain and DNS records. See <<before-you-begin>> to create the DNS records, and xref:ch2-networking-guide.adoc#dns-records[DNS Records] for the CloudHub 2.0 DNS record formats.
+====
+
 The TLS contexts that you configure for the private space define the domains that are available
 when deploying apps to the private spaces.
 See xref:ch2-config-endpoints-paths.adoc[].