How to configure SSL/TLS on a legacy click-tracking domain

You will learn

How to configure a valid SSL/TLS certificate for a click-tracking domain on a legacy setup. Klaviyo provides the click tracking itself, but on this setup it does not provision or renew the certificate, so keeping your tracking links working depends on you putting one in place.

Before you begin

Complete 2 checks before you change anything. The first tells you whether this article applies to your domain. The second tells you whether you have a certificate or tracking-link problem to fix.

Step 1: Confirm your domain is on a legacy setup

The click-tracking domain controls require a paid Klaviyo plan. If you cannot access them, check the records at your DNS provider or contact Klaviyo support to confirm your setup.

1. Go to Settings > Domains in your Klaviyo account.
2. In the Click-tracking domains section, find your click-tracking domain.
3. Select the three-dot menu next to the domain and choose View records.

These are the records your domain requires rather than a live reading of your DNS, so you can check them at any time. If you want to be certain, compare them against the records at your DNS provider.

• A CNAME record pointing to a klaviyodns.com address, such as dct.klaviyodns.com, means you are on Klaviyo's current setup. Klaviyo manages your certificate and you do not need this article.
• CNAME records pointing to sendgrid.net mean your domain is on a legacy setup, and the rest of this article applies to you.

Step 2: Check the certificate and a tracked link

Open your click-tracking domain in a browser over https://. If the page loads with no security warning, a valid certificate is being served for that exact hostname. Copy a tracked link from a recent email sent using this domain. If it starts with http://, change only that prefix to https://. Open the link and confirm that it reaches the intended page. A certificate check alone does not test the tracking redirect. If you see a certificate warning, your tracking links are at risk and the rest of this article applies.

Being on a legacy setup does not by itself mean anything is wrong. If your certificate is valid and your tracked links work, no certificate change is needed. Repeat these checks periodically, because a configuration that works today can stop working later, for example when a certificate expires or a CDN changes.

You will need access to your DNS provider and to a CDN platform.

Why this matters now

2 things make a missing or invalid certificate more serious than it used to be.

Browsers can upgrade HTTP links to HTTPS. Depending on the browser and its security settings, recipients can see a warning or be blocked from opening a click-tracking link if the domain cannot serve a valid certificate.

Your own domain may already require HTTPS. If your root domain sends an HSTS policy that includes the includeSubDomains directive, browsers enforce HTTPS on your click-tracking subdomain as well. On a host covered by that policy, a certificate problem becomes a hard failure with no option to continue, rather than a warning a recipient can click past.

You can check your policy with a tool such as this HSTS test, run against both your root domain and your click-tracking domain. If your root domain’s policy includes includeSubDomains, the root-domain policy also covers your click-tracking subdomain. A policy without that directive does not extend from the root domain to the subdomain, but the click-tracking subdomain can have its own HSTS policy.

What to configure in your CDN provider account

Any CDN that can proxy requests to a custom origin and serve your own SSL/TLS certificate will work. Klaviyo does not require a particular provider. What matters is that your configuration meets all of the requirements below.

• Origin: point the CDN at sendgrid.net.
• Host header: send your click-tracking domain as the Host header on requests to the origin. This is the requirement general CDN guidance most often misses, and the setup will not work without it.
• Connection to the origin: if your CDN connects to the origin over HTTPS, it must validate the origin certificate against sendgrid.net rather than against the Host header you are forwarding. If your CDN cannot separate those 2 values, connect to the origin over HTTP instead. The connection between recipients and the CDN remains encrypted, but the HTTP connection from the CDN to the origin is unencrypted.
• Certificate: serve a valid, publicly trusted SSL/TLS certificate for your exact click-tracking hostname. A certificate covering only your root domain will not cover the subdomain.
• Caching: turn caching off. Click-tracking requests are one-time redirects and must not be cached.
• Query strings: forward the full query string to the origin. Tracking information is carried in the URL, and stripping it breaks the redirect.
• DNS: configure your click-tracking hostname as your CDN provider instructs so that requests pass through the CDN. If your provider gives you a target hostname, point a CNAME record to it and confirm that your tracking hostname resolves publicly. If you use Cloudflare as the CDN, turn on proxying for the tracking hostname; proxied records return Cloudflare IP addresses instead of a public CNAME. A redirect, domain forwarding, or URL masking rule at your DNS provider is not sufficient. The CDN has to proxy the request and serve the certificate itself.

Common problems

If your links do not work after you set up the CDN, these are the usual causes.

• Every tracking link returns a 502 or bad gateway error. Check your CDN's error details. An origin certificate that does not match the hostname used for validation can cause this error. For that mismatch, configure the CDN to validate the origin certificate against sendgrid.net, or use HTTP to the origin as described above. Other causes include DNS problems or an origin that cannot be reached.
• Recipients see a certificate warning naming a different domain. The certificate your CDN is serving does not cover your exact click-tracking hostname. Confirm the hostname is listed on the certificate and that the certificate has not expired.
• The CDN is passing traffic, but your domain still does not load over HTTPS. Check that HTTPS is enabled and that your CDN is serving a valid certificate for your click-tracking hostname. If the certificate is missing, add it in your provider's TLS or SSL settings.
• Links used to work and recently stopped. Check the certificate's expiry date and confirm your click-tracking domain is still configured in your CDN. If both are correct, check the DNS and origin settings above.

Provider documentation

Klaviyo does not manage these services and cannot troubleshoot inside them. Use your provider's own documentation for the exact steps, and map those steps to the requirements above.

• Cloudflare: use a configuration rule to set SSL/TLS mode for your click-tracking hostname.
• Fastly: set the override host to your click-tracking domain, and set the certificate and SNI hostnames to the origin. You also need to add a certificate for your domain under TLS management, which is separate from the origin settings.
• Amazon CloudFront: your certificate must be issued in the US East (N. Virginia) region to be selectable, and your click-tracking domain is added as an alternate domain name.
• bunny.net: your click-tracking domain is added as a custom hostname on a pull zone, and the Host header is set with an edge rule.
• KeyCDN: your click-tracking domain is added as a zone alias on a pull zone.

If your provider is not listed, look for the equivalent settings: a custom origin, a way to override the Host header sent to that origin, a custom domain with its own SSL/TLS certificate, and a way to disable caching.

Tell Klaviyo when your certificate is ready

Configuring the certificate makes your click-tracking domain reachable over https, but it does not change the links Klaviyo writes into your emails. Depending on your account settings, those may still be written as http until Klaviyo updates the setting on your domain.

First, verify your certificate yourself. Open your click-tracking domain in a browser over https:// and confirm the page loads with no security warning and a valid certificate for that exact hostname. Also test a tracked link from a recent email sent using this domain over HTTPS. If it starts with http://, change only that prefix to https://, then confirm that the link reaches the intended page.

Then contact Klaviyo support. Ask them to make sure your legacy click-tracking domain is set to write https links going forward. Once that is in place, tracking links in emails you send from then on will use https, which is the more secure setup and the one browsers increasingly expect.

This change applies to emails you send after it is made. It does not rewrite links in emails you have already sent.

After support confirms the change, check a tracked link in the next email you send. Confirm that it starts with https:// and reaches the intended page.

If you would rather not manage SSL/TLS certificates using a CDN

You can move to Klaviyo-provided click tracking instead. On that setup Klaviyo issues and renews the SSL/TLS certificate for you, and there is nothing for you to maintain.

To set up a new click-tracking domain, you need a paid Klaviyo plan and permission to manage domains.

Removing the legacy configuration in Klaviyo does not delete the CNAME record at your DNS provider. As long as you leave that record and your CDN in place, links in emails you have already sent continue to resolve. Removing the domain does disconnect any associated Universal Links or Android App Links. Before removing the domain, contact Klaviyo support if you need to preserve these links.

1. When you are ready to switch, go to Settings > Domains. In Click-tracking domains, open the three-dot menu next to the legacy domain, select Remove, and confirm the removal.
2. In Click-tracking domains, select Add Domain. Choose a different subdomain from the legacy one so that the legacy DNS record can stay in place, and complete the DNS setup.
3. Once the new domain is verified, select Activate and confirm. Future emails will use the new click-tracking domain.

The switch applies going forward only. Klaviyo can provide a certificate for links in the emails you send after switching, but not for links in emails you have already sent on your legacy domain. Those still need a CDN if you want them to resolve over https.

Depending on your account settings, links in emails you have already sent may have been written as http://. Browsers can upgrade those links to https://, so the legacy hostname still needs a valid certificate when an upgrade occurs. The vast majority of clicks occur within 48 hours of an email send, so addressing past links may not be necessary for every sender. Consider how far back your recipients are likely to click before you decide.

For setup steps, see How to set up dedicated click tracking.