When open and click tracking is enabled, SES rewrites links in your emails to route them through a tracking endpoint. By default, these tracking URLs use a generic SES domain. A custom tracking domain replaces that with a subdomain you control, so tracking links match your brand.

## Why use a custom tracking domain?

- **Better deliverability** — Spam filters look at link domains in your email. When tracking links use your own domain instead of a shared SES domain, your messages appear more consistent and trustworthy.
- **Branded URLs** — Recipients see links like `track.yourdomain.com/...` instead of a generic AWS tracking URL. This builds trust and reduces the chance of recipients flagging your emails as suspicious.
- **Domain reputation isolation** — Your tracking domain carries only your reputation, not the reputation of other SES customers sharing the default tracking domain.


  You can send email and track opens and clicks without a custom tracking domain. SES will use its default tracking endpoint. However, a custom tracking domain is recommended for production sending to maximize deliverability and maintain a professional appearance.



  Each organization can have up to **10 tracking domains**. If you need more, consider consolidating subdomains or removing unused ones.


## Setting up a tracking domain

In the SendOps dashboard at [app.sendops.dev](https://app.sendops.dev), open **Infrastructure** in the sidebar and select the **Tracking Domains** tab. Click **Add Tracking Domain** to open the creation wizard.


  <Step title="Enter your subdomain">
    Pick a subdomain dedicated to tracking, such as `track.yourdomain.com` or `links.yourdomain.com`. This must be a subdomain (containing at least one dot), not a bare domain. It should not be used for anything else (e.g., not your website or email).

    Enter the subdomain and click **Continue**.
  </Step>

  <Step title="Choose protocol">
    Select how tracking links are served. The available options depend on whether you have an active [Edge stack](/edge/edge-stack):

    - **HTTP** — Simple setup. Your CNAME record points directly to the SES tracking endpoint (`r.<region>.awstrack.me`). No certificate or CDN is needed.
    - **HTTPS — Managed** *(recommended; shown only when your Edge stack is active)* — Uses your Edge stack's branded tracking distribution. SendOps requests an SSL certificate for your subdomain and attaches it automatically — there is no CDN for you to manage. You don't provide a CDN domain.
    - **HTTPS — Custom CDN** — Bring your own CDN distribution (e.g., CloudFront) that terminates TLS and proxies to SES. You must provide the **CDN Domain** (e.g., `d1234567890.cloudfront.net`).

    <Callout type="info" title="Want managed HTTPS?">
      The **HTTPS — Managed** option only appears once your [Edge stack](/edge/edge-stack) is active. If you don't see it, enable the Edge stack first, or use HTTP / your own CDN.
    </Callout>

    Click **Create Domain** to proceed.
  </Step>

  <Step title="Configure DNS records">
    After creation, the wizard displays all the DNS records you need to add at your DNS provider. There are two sets of records:

    **Tracking CNAME record** — Routes tracking link requests to the correct endpoint.

    | Type | Name | Value |
    |------|------|-------|
    | CNAME | `track.yourdomain.com` | the CNAME target shown in the dashboard |

    The exact CNAME target depends on the protocol you chose:

    - **HTTP** — the SES regional tracking endpoint (`r.<region>.awstrack.me`).
    - **HTTPS — Managed** — your Edge stack's branded tracking distribution domain.
    - **HTTPS — Custom CDN** — the CDN domain you provided.

    **DKIM records** — Creating a tracking domain also creates an SES email identity for your subdomain. SES generates three CNAME records for DKIM signing that must be added to your DNS.

    | Type | Name | Value |
    |------|------|-------|
    | CNAME | `{token1}._domainkey.track.yourdomain.com` | `{token1}.dkim.amazonses.com` |
    | CNAME | `{token2}._domainkey.track.yourdomain.com` | `{token2}.dkim.amazonses.com` |
    | CNAME | `{token3}._domainkey.track.yourdomain.com` | `{token3}.dkim.amazonses.com` |

    The token values are unique to your domain and are generated by AWS SES. Use the copy buttons in the dashboard to avoid transcription errors.

    <Callout type="info" title="Managed HTTPS also needs a certificate record">
      If you chose **HTTPS — Managed**, SendOps requests an SSL certificate for your subdomain. On the detail page you'll find a **Branded Certificate** card with an additional ACM validation **CNAME** record to add — issuance completes automatically once AWS detects it. See [Branded certificate](#branded-certificate-managed-https) below.
    </Callout>

    Click **Continue to Verification** to go to the detail page and monitor verification progress.
  </Step>



  DNS changes typically propagate within a few minutes, but in some cases can take longer depending on your DNS provider and TTL settings. If your domain still shows as pending after a few hours, double-check that the records were entered exactly as shown in the dashboard.


## Verification

Verification is tracked separately for two components:

- **DNS CNAME** — Confirms that your subdomain's CNAME record resolves to the expected target.
- **SES Identity (DKIM)** — Confirms that the DKIM records are in place and SES has verified the email identity.

Each component has its own status:

| Status | Meaning |
|--------|---------|
| **pending** | Waiting for DNS records to be detected. Verification is polling automatically. |
| **verified** | The records have been confirmed. |
| **failed** | Verification timed out after 7 days or SES reported a failure. |
| **invalid** | DNS CNAME was previously verified but now points to a different target (drift detected). |

The tracking domain is fully active only when both DNS CNAME and SES Identity show **verified**.

### Automatic background verification

After you create a tracking domain, SendOps automatically polls for verification on a decay schedule:

- Every **2 minutes** during the first hour.
- Every **10 minutes** during the first day.
- Every **hour** after the first day, up to **7 days**.

If both checks are not verified within 7 days, the status is set to **failed**.

### Manual verification

On the tracking domain detail page, click **Verify Now** to trigger an immediate check. There is a **30-second cooldown** between manual verification attempts.

## Tracking Domains list page

The list page at **Tracking Domains** displays a table with the following columns:

| Column | Description |
|--------|-------------|
| **Subdomain** | The tracking subdomain (e.g., `track.yourdomain.com`). |
| **Protocol** | Badge showing HTTP or HTTPS. |
| **Status** | Combined verification status (verified, pending, failed, or invalid). |
| **Created** | When the tracking domain was created (relative time). |

Click any row to open the detail page for that tracking domain.

## Tracking domain detail page

The detail page shows full configuration and status for a tracking domain.

### Verification Status card

Displays DNS CNAME and SES Identity (DKIM) verification statuses side by side, each with their last-checked or last-verified timestamp. If verification encountered an error, it is displayed below the statuses. A **Verify Now** button triggers an immediate re-check when verification is not yet complete.

### Configuration card

Shows the domain's configuration:

- **Protocol** — HTTP or HTTPS.
- **Region** — The AWS region used for this tracking domain.
- **CNAME Target** — The value your CNAME record should point to.
- **SES Tracking Endpoint** — The subdomain registered with SES.

For **HTTPS — Managed** domains, the CDN domain is shown with an **Edge** badge and is not editable — it's sourced from your Edge stack's tracking distribution.

For **HTTPS — Custom CDN** domains, a **CDN Domain** field is shown that you can edit at any time by clicking **Edit**, entering the new CDN domain, and clicking **Save**. Changing the CDN domain also updates the CNAME target, so you will need to update your DNS records accordingly.

### Branded Certificate (managed HTTPS)

For **HTTPS — Managed** domains, a **Branded Certificate** card shows the state of the TLS certificate SendOps requests and attaches to your Edge tracking distribution:

- While **pending**, the card displays the ACM validation **CNAME** record(s) to add at your DNS provider (with copy buttons). Issuance completes automatically once AWS detects them.
- If issuance **fails or times out**, confirm the validation record is published and recreate the tracking domain.

The card polls automatically while the certificate is pending.

### Channels

Once a tracking domain is fully ready — DNS CNAME verified, SES identity (DKIM) verified, and (for managed HTTPS) the certificate issued — you can attach it to your [channels](/channels/understanding-channels) from the **Channels** card on the detail page. SES then rewrites open and click links onto this branded domain at send time for any channel you attach. Use **Detach** to stop using it for a channel.

### DNS Records accordion

An expandable accordion showing the tracking CNAME record and DKIM records for reference. Use the copy buttons to copy record values.

### Danger Zone

Contains the **Delete Tracking Domain** button, which permanently removes the tracking domain.

## How tracking works with a custom domain

Once your tracking domain is fully verified:

1. When you send an email with open or click tracking enabled, SES rewrites links to route through your tracking subdomain (e.g., `http://track.yourdomain.com/click/...`).
2. When a recipient clicks a link, the request hits your tracking CNAME, which resolves to the SES tracking endpoint (or your CDN for HTTPS).
3. SES logs the click event and redirects the recipient to the original destination URL.
4. Open tracking works similarly — a small transparent pixel is loaded from your tracking domain, and the event is logged.

## Deleting a tracking domain

You can delete a tracking domain from the detail page under the **Danger Zone** section. Deletion requires confirmation.


  Deleting a tracking domain removes the SES email identity and the database record. Any tracking links that use this domain will **stop working** immediately. You will need to **manually remove** the CNAME and DKIM DNS records from your DNS provider — SendOps cannot do this for you. This action cannot be undone.


## What's next?

- Review the full DNS setup for your domain in [DNS Configuration](/domains/dns-configuration).
- Organize your domains and identities into [Channels](/channels/understanding-channels) for grouped reporting.
- Monitor click and open rates in [Engagement Metrics](/reports/engagement-metrics).