Configuring HTTPS for Link Tracking Domains

When users click links in emails you've sent with Iterable, they're first taken to your link tracking domain. This domain tracks clicks (so you can analyze campaign engagement), sets attribution-related cookies in the browser (to help you measure campaign conversions), and finally redirects your users to their intended destinations.

Iterable's default link tracking domain is links.iterable.com (USDC-based projects) or links.eu.iterable.com (EDC-based projects).

However, since users may see this domain in your messages (for example, when hovering over a link), it's a good idea for this link to be associated with your brand. For example, something like links.example.com or links.subdomain.example.com (where example.com represents your root domain).

Whatever custom link tracking domain you choose, Iterable will host it. Because of this, you'll need to configure your DNS for this domain (as described below).

For various reasons, you should almost certainly configure your link tracking domains to use HTTPS:

• Sites you link to may implement HSTS, which requires incoming requests to use HTTPS. You should enable HTTPS for the initial request from your user's browser to your link tracking domain, and also for the tracking domain's redirect to the intended link destination.

• At your link tracking domain, Iterable hosts files related to your mobile deep linking configuration: apple-app-site-association and assetlinks.json. For deep linking to work, iOS and Android both require these files to be served up using HTTPS.

• HTTPS is a security best practice, and should be used whenever possible. Your users expect it.

To set up HTTPS for your link tracking domain, you'll need to use a CDN such as Amazon CloudFront or Cloudflare. This guide describes how to do it with Amazon CloudFront.

# In this article

To use Amazon CloudFront to implement HTTPS for your link tracking domain, follow these steps:

# Preliminary information

Throughout this article, <YOUR_LINK_TRACKING_DOMAIN> refers to your selected link tracking domain. For example, something like links.example.com or links.subdomain.example.com (where example.com is your root domain).

# Step 1: Generate an SSL certificate

First, generate an SSL certificate for the link tracking domain. To do this, use AWS Certificate Manager (ACM) or a similar service. For more information, read Amazon's documentation.

To generate a certificate with AWS Certificate Manager and set up a CloudFront distribution, follow these steps:

1. If you don't already have one, set up a free AWS account at https://aws.amazon.com/console/.

2. Navigate to the AWS Management Console, found at https://aws.amazon.com/console/.

3. Click Services.

4. In the Security, Identity, & Compliance section, click Certificate Manager.

5. Click Request a Certificate.

   NOTE

   If you've already requested certificates in the past, you'll instead need to click Request in the Certificate Manager.

6. Choose Request a public certificate and click Next.

7. Enter the following information:

   • Fully qualified domain name — <YOUR_LINK_TRACKING_DOMAIN> (for example, links.example.com)

   • Select validation method — DNS validation - recommended

   • Tags — (Optional)

   

   • Then, click Request.

8. On the Certificates page, load your certificate request by clicking the Refresh icon.

9. To open your certificate, click on its Certificate ID.

10. Refresh the page until the Domains section populates CNAME name and CNAME value.

11. In your DNS management tool, add the CNAME record provided by AWS.

12. In AWS, go back to the Certificates page and wait (for a few minutes) for the certificate Status to change from Pending validation to Issued.

After the certificate has been issued, continue to the next step.

# Step 2: Create and configure a CloudFront distribution

To create and configure a CloudFront distribution:

1. Visit https://console.aws.amazon.com/cloudfront/.

2. Click Create Distribution.

3. Configure the distribution using the following settings:

# Origin

# Default Cache Behavior

# Settings

4. Once you confirm that everything is correct, click Create Distribution.

# Step 3: Wait for your CloudFront distribution to deploy

On the CloudFront Distributions page, your distribution should have an In Progress status with a spinning arrow. When its status changes to Deployed, copy its URL (on the General tab, the Distribution Domain Name). You'll need this when updating your DNS.

# Step 4: Confirm the configuration of your CloudFront distribution

To confirm your distribution's configuration, use the openssl command-line tool:

openssl s_client -servername [CNAME] -connect <YOUR_CLOUDFRONT_URL>:443

If the command's output doesn't show your certificate, double-check your distribution's settings in CloudFront.

# Step 5: Update your DNS

In your DNS settings, create a CNAME record, using this pattern:

<YOUR_TRACKING_DOMAIN> CNAME <YOUR_CLOUDFRONT_URL>

For example:

links.example.com CNAME c66b0cd6312.cloudfront.net

# Step 6: Set up your tracking domain in Iterable

To set up your link tracking domain in Iterable:

1. In Iterable, navigate to Settings > Domains and set up a tracking domain (for example, links.example.com, where example.com is your root domain).

2. If you're using a single sending domain from Amazon SES, set the new tracking domain as the default. Otherwise, your project will continue to use links.iterable.com (or links.eu.iterable.com) as its default tracking domain.

3. Edit the new tracking domain, and toggle on Enable HTTPS.

For more information, read Email Setup.