How to configure SSL/TLS on a legacy click-tracking domain

You will learn

How to configure a valid SSL/TLS certificate for a click-tracking domain on a legacy setup. Klaviyo provides the click tracking itself, but on this setup it does not provision or renew the certificate, so keeping your tracking links working depends on you putting one in place.

Before you begin

Two checks before you change anything. The first tells you whether this article applies to your domain. The second tells you whether you actually have a problem to fix.

Step 1: Confirm your domain is on a legacy setup

Go to Settings > Domains in your Klaviyo account. In the Click-tracking domains section, find your click-tracking domain, select the kebab menu (three dots) next to it, and choose View records. These are the records your domain requires rather than a live reading of your DNS, so you can check them at any time. If you want to be certain, compare them against the records at your DNS provider.

• A CNAME record pointing to a klaviyodns.com address, such as dct.klaviyodns.com, means you are on Klaviyo's current setup. Klaviyo manages your certificate and you do not need this article.
• CNAME records pointing to sendgrid.net mean your domain is on a legacy setup, and the rest of this article applies to you.

Step 2: Confirm whether a valid certificate is being served

Open your click-tracking domain in a browser over https://. If the page loads with no security warning, a valid certificate is already being served for that exact hostname and your tracking links are fine. If you see a certificate warning, your tracking links are at risk and the rest of this article applies.

Being on a legacy setup does not by itself mean anything is wrong. Many of these domains have a valid certificate in place and need no action. It is worth re-running this check periodically, because a configuration that works today can stop working later, for example when a certificate expires or a CDN changes.

You will need access to your DNS provider and to a CDN platform.

Why this matters now

Two things make a missing or invalid certificate more serious than it used to be.

Browsers are enforcing HTTPS by default. Browsers are increasingly requiring secure connections, so a click-tracking domain without a valid certificate will fail for a growing share of your recipients over time, rather than simply showing a warning they can dismiss.

Your own domain may already require HTTPS. If your root domain sends an HSTS policy that includes the includeSubDomains directive, browsers enforce HTTPS on your click-tracking subdomain as well. On a host covered by that policy, a certificate problem becomes a hard failure with no option to continue, rather than a warning a recipient can click past.

You can check your policy with a tool such as this HSTS test, run against both your root domain and your click-tracking domain. If the policy includes includeSubDomains, your click-tracking domain is covered by it. If the policy applies to your root domain only, your click-tracking domain is not covered and HSTS is not a factor for you.

What to configure in your CDN provider account

Any CDN that can proxy requests to a custom origin and serve your own SSL/TLS certificate will work. Klaviyo does not require a particular provider. What matters is that your configuration meets all of the requirements below.

• Origin: point the CDN at sendgrid.net.
• Host header: send your click-tracking domain as the Host header on requests to the origin. This is the requirement general CDN guidance most often misses, and the setup will not work without it.
• Connection to the origin: if your CDN connects to the origin over HTTPS, it must validate the origin certificate against sendgrid.net rather than against the Host header you are forwarding. If your CDN cannot separate those two values, connect to the origin over HTTP instead. Your recipients' connection is still secure either way, because it terminates at the CDN.
• Certificate: serve a valid, publicly trusted SSL/TLS certificate for your exact click-tracking hostname. A certificate covering only your root domain will not cover the subdomain.
• Caching: turn caching off. Click-tracking requests are one-time redirects and must not be cached.
• Query strings: forward the full query string to the origin. Tracking information is carried in the URL, and stripping it breaks the redirect.
• DNS: point your click-tracking domain at the CDN with a CNAME record, and confirm the record resolves publicly. A redirect, domain forwarding, or URL masking rule at your DNS provider is not sufficient. The CDN has to proxy the request and serve the certificate itself.

Common problems

If your links do not work after you set up the CDN, these are the usual causes.

• Every tracking link returns a 502 or bad gateway error. Your CDN is connecting to the origin over HTTPS while forwarding your click-tracking domain as the Host header, and the origin certificate does not match that name. Either connect to the origin over HTTP, or configure the CDN to validate the origin certificate against sendgrid.net.
• Recipients see a certificate warning naming a different domain. The certificate your CDN is serving does not cover your exact click-tracking hostname. Confirm the hostname is listed on the certificate and that the certificate has not expired.
• The CDN is passing traffic, but your domain still does not load over https. The proxy side is working and the certificate step was missed. Add your SSL/TLS certificate in your provider's TLS or SSL settings.
• Links used to work and recently stopped. A certificate has expired, or the CDN that was serving it has been removed or reconfigured. Check the certificate's expiry date and confirm your click-tracking domain is still configured in your CDN.

Provider documentation

Klaviyo does not manage these services and cannot troubleshoot inside them. Use your provider's own documentation for the exact steps, and map those steps to the requirements above.

• Cloudflare: SSL/TLS mode is set per hostname with a configuration rule. Note that Cloudflare has replaced page rules, so older instructions you may find will not match the current dashboard.
• Fastly: set the override host to your click-tracking domain, and set the certificate and SNI hostnames to the origin. You also need to add a certificate for your domain under TLS management, which is separate from the origin settings.
• Amazon CloudFront: your certificate must be issued in the US East (N. Virginia) region to be selectable, and your click-tracking domain is added as an alternate domain name.
• bunny.net: your click-tracking domain is added as a custom hostname on a pull zone, and the Host header is set with an edge rule.
• KeyCDN: your click-tracking domain is added as a zone alias on a pull zone.

If your provider is not listed, look for the equivalent settings: a custom origin, a way to override the Host header sent to that origin, a custom domain with its own SSL/TLS certificate, and a way to disable caching.

Tell Klaviyo when your certificate is ready

Configuring the certificate makes your click-tracking domain reachable over https, but it does not change the links Klaviyo writes into your emails. Depending on your account settings, those may still be written as http until Klaviyo updates the setting on your domain.

First, verify your certificate yourself. Open your click-tracking domain in a browser over https:// and confirm the page loads with no security warning and a valid certificate for that exact hostname.

Then contact Klaviyo support. Ask them to make sure your legacy click-tracking domain is set to write https links going forward. Once that is in place, tracking links in emails you send from then on will use https, which is the more secure setup and the one browsers increasingly expect.

This change applies to emails you send after it is made. It does not rewrite links in emails you have already sent.

If you would rather not manage SSL/TLS certificates using a CDN

You can move to Klaviyo-provided click tracking instead. On that setup Klaviyo issues and renews the SSL/TLS certificate for you, and there is nothing for you to maintain.

To do this you must first remove your legacy click-tracking domain in Klaviyo, then add a new one from Settings > Domains. When you add the new domain, choose a different subdomain from the legacy one so that the legacy DNS record can stay where it is.

Removing the legacy configuration in Klaviyo does not delete the CNAME record at your DNS provider. As long as you leave that record and your CDN in place, links in emails you have already sent continue to resolve.

The switch applies going forward only. Klaviyo can provide a certificate for links in the emails you send after switching, but not for links in emails you have already sent on your legacy domain. Those still need a CDN if you want them to resolve over https.

Depending on your account settings, links in emails you have already sent may have been written as http://. Those links will continue to resolve over http://. Keep in mind that this is the behavior browsers are moving away from, so they become less reliable over time rather than failing all at once. The vast majority of clicks occur within 48 hours of an email send, so addressing past links may not be necessary for every sender. Consider how far back your recipients are likely to click before you decide.

For setup steps, see How to set up dedicated click tracking.