diff --git a/setup/start/custom.yml b/setup/start/custom.yml
index ad6436751..2ada74a73 100644
--- a/setup/start/custom.yml
+++ b/setup/start/custom.yml
@@ -6,6 +6,7 @@
 #
 # domains:
 #   dynamicDns: true
+#   changeDashboardDomain: true
 #
 # subscription:
 #   configurable: true
diff --git a/src/custom.js b/src/custom.js
index 2f4546b5f..c36071cf7 100644
--- a/src/custom.js
+++ b/src/custom.js
@@ -17,7 +17,8 @@ const DEFAULT_SPEC = {
         configurable: true
     },
     domains: {
-        dynamicDns: true
+        dynamicDns: true,
+        changeDashboardDomain: true
     },
     subscription: {
         configurable: true
diff --git a/src/routes/cloudron.js b/src/routes/cloudron.js
index 0417cf1b9..d4874ba5b 100644
--- a/src/routes/cloudron.js
+++ b/src/routes/cloudron.js
@@ -20,6 +20,7 @@ let assert = require('assert'),
     auditSource = require('../auditsource.js'),
     cloudron = require('../cloudron.js'),
     CloudronError = cloudron.CloudronError,
+    custom = require('../custom.js'),
     HttpError = require('connect-lastmile').HttpError,
     HttpSuccess = require('connect-lastmile').HttpSuccess,
     updater = require('../updater.js'),
@@ -152,6 +153,8 @@ function getLogStream(req, res, next) {
 function setDashboardAndMailDomain(req, res, next) {
     if (!req.body.domain || typeof req.body.domain !== 'string') return next(new HttpError(400, 'domain must be a string'));
 
+    if (!custom.spec().domains.changeDashboardDomain) return next(new HttpError(405, 'feature disabled by admin'));
+
     cloudron.setDashboardAndMailDomain(req.body.domain, auditSource.fromRequest(req), function (error) {
         if (error && error.reason === CloudronError.BAD_FIELD) return next(new HttpError(404, error.message));
         if (error) return next(new HttpError(500, error));
@@ -163,6 +166,8 @@ function setDashboardAndMailDomain(req, res, next) {
 function prepareDashboardDomain(req, res, next) {
     if (!req.body.domain || typeof req.body.domain !== 'string') return next(new HttpError(400, 'domain must be a string'));
 
+    if (!custom.spec().domains.changeDashboardDomain) return next(new HttpError(405, 'feature disabled by admin'));
+
     cloudron.prepareDashboardDomain(req.body.domain, auditSource.fromRequest(req), function (error, taskId) {
         if (error && error.reason === CloudronError.BAD_FIELD) return next(new HttpError(404, error.message));
         if (error && error.reason === CloudronError.BAD_STATE) return next(new HttpError(409, error.message));