HTTPS for Click Tracking

When users click links in emails you've sent with Iterable, they're first taken to your link tracking domain. This domain tracks clicks (so you can analyze campaign engagement), sets attribution-related cookies in the browser (to help you measure campaign conversions), and finally redirects your users to their intended destinations.

Iterable's default link tracking domain is links.iterable.com. However, since users may see this domain in your messages (for example, when hovering over a link), it's best to customize it so that it's associated with your brand—something like links.example.com or links.subdomain.example.com (where example.com represents your root domain).

Whatever custom link tracking domain you choose, Iterable will host it (so that it can track links, etc.). Because of this, you'll need to configure your DNS for this domain (as shown below).

In general, it's a good idea to use HTTPS with your link tracking domain—for various reasons:

• Link destinations may implement HSTS, which requires that incoming requests use HTTPS. You should enable HTTPS for the initial request from your user's browser to your link tracking domain, and also for the tracking domain's redirect to the intended link destination.
• At your link tracking domain, Iterable hosts files related to your mobile deep linking configuration (apple-app-site-association and assetlinks.json). For deep linking to work, iOS and Android both require that you serve up these files with HTTPS.
• HTTPS is a security best practice, and should be used whenever possible. Your users expect it.

To set up HTTPS for your link tracking domain, you'll need to use a CDN such as Amazon CloudFront or Cloudflare. This guide describes how to do it with Amazon CloudFront.

# Table of contents

To use Amazon CloudFront to implement HTTPS for your link tracking domain, follow these steps:

# 1. Generate an SSL certificate

Generate an SSL certificate for the link tracking domain. To do this, use AWS Cerftificate Manager (ACM) or a similar service. For more information, read Amazon's documentation.

After approving the certificate, continue to the next step.

# 2. Create and configure a CloudFront distribution

To create and configure a CloudFront distribution, visit https://console.aws.amazon.com/cloudfront/ and click Create Distribution. Select Web as your delivery method, and set the configuration settings described below. When you're done, click Create Distribution.

# Origin Settings

# Default Cache Behavior Settings

# Distribution Settings

# 3. Wait for your CloudFront distribution to deploy

On the CloudFront Distributions page, your distribution should have an In Progress status with a spinning arrow. When its status changes to *Deployed, copy the its URL from Domain Name (on the General tab). You'll need this when updating your DNS.

# 4. Confirm the configuration of your CloudFront distribution

To confirm your distribution's configuration, use the openssl command-line tool:

openssl s_client -servername [CNAME] -connect <YOUR_CLOUDFRONT_URL>:443

If the command's output doesn't show your certificate, double-check your distribution's settings in CloudFront.

# 5. Update your DNS

In your DNS settings, create a CNAME record, using this pattern:

<YOUR_TRACKING_DOMAIN> CNAME <YOUR_CLOUDFRONT_URL>

For example:

links.example.com CNAME d49jhgak555.cloudfront.net

# 6. Set up your tracking domain in Iterable

To set up your link tracking domain in Iterable:

1. In Iterable, navigate to Settings > Mail Domains and add <YOUR_TRACKING_DOMAIN> (for example, links.example.com) as a tracking domain.

2. If you're using a single sending domain from Amazon SES, set the new tracking domain as the default. Otherwise, your project will continue to use links.iterable.com as its default tracking domain.

3. Edit the new tracking domain, and toggle on Enable HTTPS.

For more information, read Sending Domains, Tracking Domains and Deep Links.