The links in your email resolve through a domain most senders never chose. Why shared tracking hosts get blocklisted and what a branded CNAME actually fixes.
Authentication work concentrates on the domain in the From header, and receivers read a second set of domains that most senders never deliberately chose: the hostnames every link in the message resolves through. By default, click tracking rewrites your URLs to point at infrastructure your provider operates and shares with its entire customer base. Those hostnames carry their own reputation, appear on URL blocklists, and travel inside your message. Our subdomain architecture guide treated sending streams; the same reasoning applies to links, and the fix is nearly as cheap.
What rewriting does to a message
Click tracking works by replacing each destination URL with one pointing at a tracking host, carrying an identifier that maps back to the recipient and the original target. The host records the request and issues a redirect. The consequence for filtering is that the domains visible to a receiver are no longer your domains: a message from your brand contains links to a hostname belonging to somebody else, which is precisely the mismatch pattern phishing produces. Receivers weigh the relationship between sending domain and link domains accordingly. In addition, a shared tracking host is a single point of contamination, because one abusive tenant can get the hostname listed and every message routed through it inherits the listing.
1Original destination
2 https://yourbrand.com/summer-sale
3
4Shared provider tracking (the default)
5 https://click.esp-provider.net/f/a/9Kd2xQ...
6
7Branded tracking on your own subdomain
8 https://links.yourbrand.com/f/a/9Kd2xQ...Setting up a branded tracking domain
The configuration, end to end
- 1
Choose a subdomain of your sending domain
links.yourbrand.com or click.yourbrand.com. Keep it under the same organisational domain as your From address so the alignment signal is genuine rather than cosmetic.
- 2
Publish the CNAME your provider specifies
The record points at provider infrastructure, which is what allows them to terminate TLS and serve the redirect. Use a low TTL until the setup is verified, then raise it.
- 3
Confirm the certificate covers the branded hostname
Most providers issue this automatically. A mismatch produces a browser warning on every click, which is considerably worse than the problem you set out to solve.
- 4
Switch tracking over per stream, not all at once
Transactional and marketing streams can use different tracking hostnames, and staging the cutover keeps one misconfiguration from affecting every send.
- 5
Verify the redirect chain is one hop
A chain that passes through the shared host and then to your branded host gives you the branding and none of the isolation. Follow a real link and count the hops.
The failure modes worth monitoring
Two problems recur once a branded domain is live. The first is a stale CNAME after an ESP migration, where the old record keeps resolving to infrastructure the previous provider still operates, leaving live links in archived campaigns pointing at a host you no longer control. Remove the record deliberately as part of the migration, and check long-running automations for hardcoded tracking URLs. The second is URL blocklisting of the branded host, which behaves like any other listing: check URIBL and SURBL data when clicks fall without a corresponding drop in opens, because a listed link domain suppresses clicks while delivery still looks entirely normal.
Link domains belong in the same category as reverse DNS and bounce-domain hygiene, which is to say invisible while correct and expensive when wrong. Setup is one DNS record and an afternoon of verification, the ongoing cost is one more hostname in your monitoring, and the benefit is that every address your recipients and their filters see belongs to you. Senders who make the change rarely report a dramatic placement lift, and they do stop appearing on lists for other people's behaviour.
Frequently Asked Questions
Does a branded tracking domain improve deliverability on its own?
Should the tracking domain match the sending subdomain exactly?
Can I disable click tracking instead?
What happens to old links if I change tracking domains?
Key Takeaways
- Click tracking rewrites every URL to a hostname your provider owns and shares across its customer base
- Receivers weigh the relationship between From domain and link domains, and shared hosts create phishing-shaped mismatch
- A branded tracking domain is one CNAME plus certificate verification, staged per stream
- The trade is that listing risk becomes yours to own and remediate, which is usually the better position
- Retire tracking CNAMEs deliberately during ESP migrations, or archived links quietly point at a provider you left
Related articles
Half-Year Review: Email in the AI Inbox Era
Six months that rearranged the reading layer: Gemini in Gmail, Microsoft rejecting outright, DMARC finally a standard. What the first half of 2026 means for senders.
Backscatter: The Bounces You Never Sent
When spammers forge your domain as their envelope sender, the bounces come to you. What backscatter is, why it happens, and how to stop causing and receiving it.
Per-Provider Playbooks: Operating Gmail, Microsoft, and Yahoo Differently
The big three score senders differently, expose different data, and fail in different ways. One operating playbook per provider beats one averaged strategy.