Does a custom tracking domain improve deliverability on its own?

Not on its own. It takes a shared redirector out of your messages and puts a name you control in its place, so the domains inside your body are scored on your own reputation instead of a stranger’s. It signs nothing and changes no authentication record, so a domain that fails SPF, DKIM or DMARC alignment has an earlier problem to fix first.

Can I use my main domain as the tracking host?

No, it has to be a subdomain. A CNAME cannot sit at a name that already holds other records, and your root domain always holds some, which is why vendors document the subdomain requirement directly. Pick an unused label such as links, click or trk under the same registrable domain as your From address.

What happens to my old campaigns if I switch platforms?

The links in them keep pointing at the old hostname, so leave the old CNAME published until those messages no longer matter to anyone. Create a new label for the new platform rather than repointing the old record, and remember that the unsubscribe link in those old messages rides the same host.

Custom tracking domain: brand links without breaking mail

Say a 14-person industrial supplier in Monterrey sends a monthly price list to its customers from a marketing platform. The mail authenticates, the From address is right, the reports look healthy. Then a buyer phones to ask whether the email is genuine, because every link in it points at a hostname nobody at the company has ever heard of. Copy cannot fix that. It is a DNS record nobody published.

Click tracking works by rewriting every link in your message so the reader passes through the platform's own web host first, the click gets counted, and the redirect then sends them where you meant. By default that host belongs to the platform and is shared with every other customer on it. A custom tracking domain, sold as link branding or dedicated click tracking depending on the vendor, swaps it for a subdomain of yours. In most products it is one CNAME record. Everything below comes from vendor and standards documentation, checked 12 October 2026.

What the links in your email actually point at

Open one of your own campaigns and hover a link without clicking. If the status bar shows a hostname you do not control, tracking is on and it runs through shared infrastructure. The same host usually serves three other things: the open-tracking pixel, the hosted unsubscribe page. One vendor's documentation states it plainly, that the recipient sees the tracking domain when they hover or click a tracked link or the unsubscribe link, and nowhere else.

Two things follow, and only one is about branding.

The recipient cannot tell your mail from a forgery. Gmail's sender guidelines ask that web links in the message body be visible and easy to understand, so recipients know what to expect when they click. A link that resolves to an unfamiliar host on somebody else's domain fails that test on sight, and it is the exact shape a phishing message has.

You are borrowing a stranger's domain reputation. Receivers score the domains inside the body of a message, not only the ones in the envelope and the headers. A shared click host is one domain that thousands of senders put in front of their links, and you inherit what the worst of them does with it.

Why a shared link host is a deliverability problem

The Spamhaus Domain Blocklist is a list of domain names with poor reputation, and it lists domains only, never IP addresses. When the domain being abused is otherwise legitimate, Spamhaus lists the specific hostname instead of the whole domain, so the rest of that domain's traffic is not caught alongside it. That mechanism exists because shared infrastructure attracts abuse, and a shared click host is shared infrastructure.

Redirectors have their own category inside that list. Spamhaus added a zone for URL shorteners and redirector domains once spammers began hiding their real destinations behind them, and it answers with a distinct code, 127.0.1.103, for an abused legitimate redirector, so each filter operator can decide whether to block outright or merely add weight. A shared click host is a redirector. When somebody else on your platform gets that host scored, your price list carries the same hostname.

Google's own guidance for bulk mail points the same way. It advises against URL shorteners in bulk sending because they hide the real destination, and it warns that hiding the true landing page of a link can lead to non-delivery. A branded tracking domain is the move in the opposite direction: the reader sees a host on your domain, and so does the filter.

Be honest about what this does not do. A tracking domain is not authentication. It signs nothing, it changes neither SPF nor DKIM nor DMARC, and it will not rescue a domain that fails alignment. If mail is landing in spam today, authentication comes first, and a dedicated sending subdomain is the piece that carries it. Branded links are a layer you add once the mail passes.

What we check before publishing anything

Five checks, in this order. Any one of them can end the job in five minutes.

Whether the platform supports it at all. Not every product does, and some offer it only on paid plans or only for certain sending types. Read the platform's own documentation rather than an article about it. Mailchimp's transactional product, one documented case, requires the custom tracking domain to be a subdomain such as clicks.example.com and will not accept a root domain. Where there is no such setting, the links stay where they are.

Which registrable domain the From address uses. The entire purpose is that the sender and the link look like the same company, so the tracking host belongs under the same registrable domain as the From address. SendGrid enforces a version of this: you enter a root domain for link branding and it has to match the domain your mail is from.

Whether the label you want is free. A CNAME cannot coexist with other records at the same name. RFC 1034 says that if a CNAME is present at a node, no other data should be there. So mail.example.com, which usually already carries an A record or an MX, is a bad choice, and an unused label such as links, click or trk is a good one.

Whether the zone is proxied. Klaviyo's setup page is explicit that DNS proxying has to be off for the click-tracking record, and names Cloudflare as where this usually bites. A proxied record answers with the proxy's own addresses, so the platform cannot see its target, verification fails, and the certificate never issues. The symptom is a record that looks perfect in your DNS panel and invisible to the vendor.

How long the hostname is. Certificates carry name-length limits in practice. HubSpot documents that it will not issue one for a name longer than 64 characters counting the subdomain, the domain and the TLD together. If the plan is trk.send.marketing.yourcompanyname.com.mx, count the characters first.

The setup, in order

Create the domain in the platform first. It generates the host and the target, and both are specific to your account. Copying a CNAME target out of a tutorial is the most common reason these never verify.
Pick the label under your sending domain. Klaviyo's automatic path appends trk to the branded sending domain your account already has, which yields a host in the shape trk.send.example.com. If you set up a dedicated sending subdomain earlier, put the tracking host beside it rather than at the apex.
Publish the CNAME with proxying off. One record, exactly as the platform printed it, host in the host field and target in the value field. SendGrid's install page lays this out as a Host column and a Points To column for a pair of records, so transcribe both and do not swap them.
Verify, and read a partial result as an error. Klaviyo re-checks the record every 15 minutes for up to two days after you create the domain. SendGrid tells you when only half of the records validated, and that is almost never propagation: it is one row entered wrong. Query the name yourself from outside your network before you blame DNS.
Wait for the certificate, then click a real link. The platform issues the certificate for your hostname once the CNAME resolves. HubSpot's published figure for its own connected domains is usually a few minutes and up to four hours. Until it lands, tracked links in a live send can break in the browser, so do not launch a campaign into that window.
Send one message to a Gmail mailbox and one to an Outlook mailbox, and click through. You are checking three things: the link resolves over HTTPS, the click registers in the platform's report, and the unsubscribe link on the branded host still loads.

; the record your platform asks for, published at your DNS host
; the target below is illustrative, use the exact value the platform generates
links.example.com.    300    IN    CNAME    sendgrid.net.

; confirm it from outside your own network before pressing Verify
dig +short CNAME links.example.com

The record you must never delete

Every link in every campaign you have already sent points at that hostname, and those messages sit in people's mailboxes for years. Remove the CNAME and the links stop resolving, which takes the archive with it, including the unsubscribe link, which a receiver is most likely to test. Klaviyo designed around exactly this: when you remove a click-tracking domain inside the app it leaves the DNS record alone by default so old links keep working, and its documentation says plainly that deleting the record at your DNS provider is what breaks them.

So treat the hostname as permanent from the day you publish it. When you change platforms, create a new label for the new vendor and leave the old record in place until the old campaigns are genuinely dead. And do not lend the host to a second tool, especially a cold-outreach product: the subdomain now carries reputation of its own, and the fastest way to get it listed is to put unsolicited mail behind it.

What we watch afterwards

Clicks recorded on the old host stay there, so expect a seam in the reporting on the day you switch.

Add the tracking hostname to whatever blocklist checking you already run for the sending domain. It is a separate name with a separate reputation, and the domain lists treat it that way. If a receiver starts bouncing or foldering mail that was fine last week, finding which list named you now includes looking up the tracking host.

Check the unsubscribe path once a quarter by using it. Bulk senders to Gmail and Yahoo have had to offer one-click unsubscribe since February 2024, the header and the hosted page usually ride the tracking host, and a certificate problem there is invisible from the inside and very visible to a receiver counting complaints. How your mail gets grouped once it arrives is a related question, covered in why Gmail files your mail under Promotions.

How Guanacos Tech helps

We do this as part of authentication and reputation work for small and mid-sized companies across North America and Latin America, in English and Spanish, through our email deliverability consulting for small business engagements. The record itself takes minutes to publish. The value is in the order: the sending subdomain first, the tracking host beside it, the certificate window kept out of a campaign send, and a note left in the zone so nobody deletes it in two years. A 30-minute call is enough for us to read your current records, one of your sent campaigns and what your platform actually supports, and say whether branded links are worth doing now.

Branded links: pointing the clicks in your email at a domain you own