Custom Tracking Domains: A CNAME Setup That Avoids Blacklists

When you send through a platform's default tracking link, every open pixel and every click redirect in your emails resolves through a hostname that hundreds of other senders also use. Spam filters and blacklist services watch that hostname's reputation, not just yours. If another account on the same shared domain gets reported for spam, the domain's reputation drops, and your links inherit the damage even though you did nothing wrong. Average cold email reply rates already sit around 3.43%¹, and a blacklisted tracking link pulls opens toward zero before a prospect ever reads your subject line. Isolating your tracking domain means a problem on someone else's account stays someone else's problem.

The CNAME itself is simple: your DNS provider needs a host entry, commonly something like track.yourdomain.com or link.yourdomain.com, pointing to the hostname your outbound platform gives you in its domain settings. The decision that matters is which domain that subdomain sits under. Hanging it off your primary corporate domain means a flag on tracking can, in some spam filters, brush up against your main domain's reputation. Many teams instead register a second, unbranded domain used only for sending and tracking, so a hit there never touches the domain on your website, your careers page, or your executive email signatures.

In your DNS provider, create a CNAME record with the host set to the subdomain your platform asked for and the value set to the exact target hostname from your platform's settings, not a shortened or guessed version of it. Save the record, then use a DNS lookup tool to confirm the subdomain resolves to that target before you tell your outbound platform to verify it. Propagation is usually done within an hour, but some registrars cache old records for up to 48 hours, so a verification failure right after saving usually means wait, not redo.

Once your platform shows the domain as verified, send a test email to an inbox you control and click the link before opening the message with tracking on. Confirm the link redirects to the right destination and that the open registers in your platform's dashboard a few minutes later. If the click works but opens never register, or vice versa, check whether your platform needs a separate record for each function; some split open-pixel and click-redirect traffic across two different CNAME targets under one setup screen.

A tracking domain earns its own reputation over time, separate from your sending domain, so treat it the same way: watch it against the major blacklists on a recurring basis rather than only when replies suddenly stop. If it does get flagged, the fix is usually to retire it and cut over to a fresh subdomain rather than trying to plead your way off a list, which can take longer than standing up a replacement. Keeping tracking on its own domain is exactly what makes that swap painless: your sending domain and brand domain never have to move.

The full setup, in order:

1. Pick a subdomain, such as track or link, and decide whether it sits under your primary domain or a separate one.
2. Create a CNAME record with that subdomain as the host and the exact target hostname from your platform's settings as the value.
3. Confirm with a DNS lookup tool that the subdomain resolves to the target before asking your platform to verify it.
4. Send a test email to an inbox you control, click the link, and check that the open registers in your dashboard.
5. Check the domain against the major blacklists on a recurring basis, and retire it for a fresh subdomain if it gets flagged.

Teams that outgrow one outbound platform and move to another often assume the tracking domain has to move with the switch. It doesn't have to: the CNAME just needs its target updated to point at the new platform's tracking hostname, and the reputation you built on that subdomain generally carries over since blacklists track the domain, not which platform happens to be sending through it at the time. What does need attention during a switch is making sure the old platform's CNAME target is actually removed once you cut over, since a dangling record pointing at a deactivated account can itself become a security issue if the old target ever gets claimed by someone else.