{"id":16517,"date":"2026-03-12T03:15:11","date_gmt":"2026-03-11T19:15:11","guid":{"rendered":"https:\/\/www.quantsnote.com\/?p=16517"},"modified":"2026-03-12T20:38:59","modified_gmt":"2026-03-12T12:38:59","slug":"aws-ses-tracking-link-https-optimization","status":"publish","type":"post","link":"https:\/\/www.quantsnote.com\/en\/aws-ses-tracking-link-https-optimization\/","title":{"rendered":"Overcoming AWS SES Tracking Link Limitations: Optimizing Deliverability from HTTP to HTTPS"},"content":{"rendered":"

Case Review: The HTTP Tracking Traps of SendGrid and AWS SES<\/h2>\n\n\n\n

Although major mainstream ESPs offer custom tracking domain features, their default configurations often suffer from a technical flaw: insufficient support for SSL certificates.<\/p>\n\n\n\n

SendGrid's Custom Domains Still Lack HTTPS<\/h3>\n\n\n\n

Observing the marketing email configuration of a well-known computer manufacturer in the market. Figure 1 shows that the brand uses SendGrid to send marketing emails, and the sender domain is consistent with their official website. Upon further inspecting the internal link structure of the email (Figure 2), the brand has indeed enabled SendGrid's Custom Tracking Domain feature, replacing the Host of the tracking link with a subdomain of their brand domain.<\/p>\n\n\n\n

\"Figure<\/a>
Figure 1: Marketing email from a well-known computer brand<\/figcaption><\/figure>\n\n\n\n
\"Figure<\/a>
Figure 2: Tracking link without HTTPS encryption<\/figcaption><\/figure>\n\n\n\n

By opening the browser's developer tools to capture the full URL (Figure 3), we can see that the protocol of the tracking link is http:\/\/<\/code>. SendGrid's default custom tracking domain solution lacks native HTTPS support. To deploy an SSL certificate for SendGrid tracking links, users must manually configure certificates and routing rules via a Reverse Proxy or a Content Delivery Network (CDN). This additional engineering hurdle leads most companies to simply use the default HTTP configuration, increasing the risk of their emails being flagged as \"unsafe\" by major email clients.<\/p>\n\n\n\n

\"Figure<\/a>
Figure 3: Inspecting the link source code<\/figcaption><\/figure>\n\n\n\n

AWS SES's awstrack Shared Domain and HTTP Limitations<\/h3>\n\n\n\n

AWS SES (Amazon Simple Email Service) is the underlying sending engine relied upon by many SaaS products. Looking back at Quants Note's previous architecture, when using AWS SES's default tracking feature, the original links would be converted to a domain ending in awstrack.me<\/code> (Figure 4).<\/p>\n\n\n\n

\"Figure<\/a>
Figure 4: AWS SES tracking link domain<\/figcaption><\/figure>\n\n\n\n

Using a shared tracking domain like awstrack.me<\/code> brings two problems. First, the sending domain and the link domain are inconsistent (Domain Mismatch), which is a negative factor in phishing email pattern matching. Second, the reputation score of this shared domain is collectively borne by all AWS SES users. If other bad actors use this domain to send spam, it will inadvertently drag down your email deliverability.<\/p>\n\n\n\n

Even if a custom tracking domain is configured in AWS SES, the links generated under the default state are still in HTTP format. To implement an HTTPS custom tracking domain within the AWS infrastructure, you must integrate Amazon CloudFront and API Gateway to receive requests via HTTPS and then forward them to the SES tracking node. The high architectural complexity also increases maintenance costs.<\/p>\n\n\n\n\n\n

\n

If you have not yet completed the setup of your AWS foundational environment, please refer to our Amazon SES Application and Configuration Guide<\/a> first.<\/p>\n<\/blockquote>\n\n\n\n

How HTTP Tracking Links Trigger Spam Filters<\/h2>\n\n\n\n

Unencrypted HTTP links are already considered high-risk characteristics in modern network environments. When scoring, spam filters incorporate the URL structure within the email into their calculation models.<\/p>\n\n\n\n

When filters scan tracking links starting with http:\/\/<\/code>, it causes the following negative impacts:<\/p>\n\n\n\n

    \n
  1. Triggering Phishing Warnings<\/strong>: Most email clients (like Gmail, Outlook) issue security warnings for HTTP links. If the link is hidden behind a button or inconsistent anchor text, filters will determine it to have deceptive intent.<\/li>\n\n\n\n
  2. Mixed Content Issues<\/strong>: If a recipient clicks an HTTP link in a web-based email client that enforces HTTPS, the browser might block the redirect, causing lost click data and disrupting the user experience.<\/li>\n\n\n\n
  3. Decreased Reputation Rating<\/strong>: ISPs (Internet Service Providers) tend to trust senders who fully adopt encrypted transmissions. An email filled with unencrypted links will directly lower the domain's overall Sender Reputation.<\/li>\n<\/ol>\n\n\n\n
    \"Email<\/figure>\n\n\n\n

    SureContact in Practice: Building a Pure HTTPS Custom Tracking Domain<\/h2>\n\n\n\n

    To resolve the deliverability bottlenecks caused by default ESP configurations, Quants Note introduced SureContact for email automation and membership management.<\/p>\n\n\n\n

    SureContact's system design significantly simplifies the deployment threshold for custom tracking domains. According to the backend configuration requirements (Figure 6), administrators only need to add a CNAME record with their domain DNS hosting provider (such as Cloudflare), pointing a dedicated tracking subdomain (e.g., link.quantsnote.com<\/code>) to SureContact's server nodes.<\/p>\n\n\n\n

    \"Figure<\/a>
    Figure 6: SureContact custom tracking domain setup<\/figcaption><\/figure>\n\n\n\n

    Figure 7 presents the link status after switching to sending with SureContact.<\/p>\n\n\n\n

    \"Figure<\/a>
    Figure 7: Current SureContact tracking link architecture<\/figcaption><\/figure>\n\n\n\n

    In practical configuration, pay special attention to one technical detail: if your DNS is managed by Cloudflare, when setting the CNAME record, you must disable the Proxy feature (keeping it in the \"DNS only \/ gray cloud\" status)<\/strong>. If the CDN proxy (orange cloud) is enabled, Cloudflare's edge nodes will intercept the traffic, causing SureContact's underlying automated certificate issuance mechanism (such as Let's Encrypt's HTTP-01 challenge) to be unable to verify the domain pointing. In the gray cloud status, the traffic reaches the endpoint directly, allowing the SureContact system to successfully pass verification and automatically issue and configure the SSL certificate for that tracking domain on their servers.<\/p>\n\n\n\n

    (Note: If users have enabled Cloudflare's Certificate Transparency Monitoring, the subsequent certificate issuance notification emails received are merely Cloudflare's \"monitoring reports\" regarding public logs; the actual provider of the HTTPS encrypted connection remains the SureContact end.)<\/em><\/em><\/p>\n\n\n\n

    After completing this one-time setup, inspecting the actual link structure output by the system shows that the URL possesses high brand consistency, and the protocol is forced to use https:\/\/<\/code>. This clean, encrypted tracking link, perfectly aligned with the sender domain, can successfully pass the URL rule checks of protection systems like SpamAssassin. This architecture effectively avoids the reputation risks of shared domains while simultaneously eliminating the cybersecurity concerns brought by HTTP links, fundamentally increasing the probability of marketing emails landing in the Primary Inbox.<\/p>\n\n\n\n

    Conclusion and System Configuration Recommendations<\/h2>\n\n\n\n

    The technical architecture of marketing emails goes beyond just the configuration of DNS records. The internal link structure of the email is also subject to strict scrutiny by filters. The HTTP tracking links generated by AWS SES and SendGrid in their default states can easily trigger phishing protection mechanisms and impact deliverability.<\/p>\n\n\n\n

    The best practice for ensuring domain reputation and deliverability is to force all click tracking links to have HTTPS encryption and to use a dedicated custom domain. This requires businesses to have the operational capability to set up reverse proxies and automatically renew SSL certificates. If the goal is to reduce architectural maintenance costs and directly obtain a complete HTTPS tracking configuration, adopting an email automation system that natively supports this feature would be a more cost-effective choice.<\/p>\n\n\n\n

    If you are looking for a system that can properly handle custom domains and HTTPS tracking links, we recommend referring to the solution we currently use: Explore SureContact Features and Configuration Now<\/a><\/p>","protected":false},"excerpt":{"rendered":"

    Are HTTP tracking links ruining your email deliverability? Learn how to overcome AWS SES and SendGrid limitations by setting up HTTPS custom tracking domains.<\/p>","protected":false},"author":1,"featured_media":16533,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_gspb_post_css":"","_surecart_dashboard_logo_width":"180px","_surecart_dashboard_show_logo":true,"_surecart_dashboard_navigation_orders":true,"_surecart_dashboard_navigation_invoices":true,"_surecart_dashboard_navigation_subscriptions":true,"_surecart_dashboard_navigation_downloads":true,"_surecart_dashboard_navigation_billing":true,"_surecart_dashboard_navigation_account":true,"_kad_blocks_custom_css":"","_kad_blocks_head_custom_js":"","_kad_blocks_body_custom_js":"","_kad_blocks_footer_custom_js":"","footnotes":""},"categories":[85,222,223],"tags":[237,298,117,176,302,241],"class_list":["post-16517","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloud-hosting","category-website-optimization","category-marketing-tips","tag-amazon-ses","tag-aws-ses","tag-domain-mailbox","tag-ssl","tag-domain-management","tag-241"],"blocksy_meta":[],"taxonomy_info":{"category":[{"value":85,"label":"\u67b6\u7ad9\u7b46\u8a18"},{"value":222,"label":"\u7db2\u7ad9\u6700\u4f73\u5316"},{"value":223,"label":"\u7db2\u8def\u884c\u92b7\u6280\u5de7"}],"post_tag":[{"value":237,"label":"Amazon SES"},{"value":298,"label":"AWS SES"},{"value":117,"label":"Domain Mailbox"},{"value":176,"label":"SSL"},{"value":302,"label":"\u7db2\u57df\u7ba1\u7406"},{"value":241,"label":"\u81ea\u52d5\u5316\u5de5\u4f5c\u6d41"}]},"featured_image_src_large":["https:\/\/www.quantsnote.com\/wp-content\/uploads\/2026\/03\/email-deliverability-optimization_new.webp",1200,655,false],"author_info":{"display_name":"Steven Tseng","author_link":"https:\/\/www.quantsnote.com\/en\/author\/feng-yin\/"},"comment_info":0,"category_info":[{"term_id":85,"name":"\u67b6\u7ad9\u7b46\u8a18","slug":"cloud-hosting","term_group":0,"term_taxonomy_id":85,"taxonomy":"category","description":"\u96f2\u7aef\u4e3b\u6a5f\u8207\u67b6\u7ad9\u7b46\u8a18\uff0c\u6db5\u84cb\u4e3b\u6a5f\u9078\u578b\u3001ServerAvatar\/Cloudways \u5be6\u52d9\u90e8\u7f72\u3001Nginx\/PHP-FPM\/SSL\/HTTP\/3 \u8a2d\u5b9a\u3001\u5b89\u5168\u6027\u8207\u5099\u4efd\u6d41\u7a0b\u3002\u4e00\u6b65\u6b65\u5e36\u4f60\u5f9e\u7a7a\u6a5f\u5230\u4e0a\u7dda\u7dad\u904b\uff0c\u4e26\u63d0\u4f9b\u5e38\u898b\u932f\u8aa4\u6392\u67e5\u8207\u6700\u4f73\u5be6\u52d9\u3002","parent":0,"count":90,"filter":"raw","cat_ID":85,"category_count":90,"category_description":"\u96f2\u7aef\u4e3b\u6a5f\u8207\u67b6\u7ad9\u7b46\u8a18\uff0c\u6db5\u84cb\u4e3b\u6a5f\u9078\u578b\u3001ServerAvatar\/Cloudways \u5be6\u52d9\u90e8\u7f72\u3001Nginx\/PHP-FPM\/SSL\/HTTP\/3 \u8a2d\u5b9a\u3001\u5b89\u5168\u6027\u8207\u5099\u4efd\u6d41\u7a0b\u3002\u4e00\u6b65\u6b65\u5e36\u4f60\u5f9e\u7a7a\u6a5f\u5230\u4e0a\u7dda\u7dad\u904b\uff0c\u4e26\u63d0\u4f9b\u5e38\u898b\u932f\u8aa4\u6392\u67e5\u8207\u6700\u4f73\u5be6\u52d9\u3002","cat_name":"\u67b6\u7ad9\u7b46\u8a18","category_nicename":"cloud-hosting","category_parent":0},{"term_id":222,"name":"\u7db2\u7ad9\u6700\u4f73\u5316","slug":"website-optimization","term_group":0,"term_taxonomy_id":222,"taxonomy":"category","description":"\u7db2\u7ad9\u6700\u4f73\u5316\u8207\u6548\u80fd\u8abf\u6821\uff1aCore Web Vitals\u3001\u5feb\u53d6 (\u4f3a\u670d\u5668\/\u7269\u4ef6\/CDN)\u3001\u5716\u7247\u8207\u524d\u7aef\u8cc7\u6e90\u6700\u4f73\u5316\u3001Cloudflare \u5be6\u52d9\uff0c\u4ee5\u53ca WordPress\/PHP \u7248\u672c\u5347\u7d1a\u8207\u76f8\u5bb9\u6027\u6aa2\u67e5\u3002\u4ee5\u6578\u64da\u8207\u6d41\u7a0b\u8b93\u901f\u5ea6\u8207\u7a69\u5b9a\u5ea6\u540c\u6b65\u63d0\u5347\u3002","parent":85,"count":26,"filter":"raw","cat_ID":222,"category_count":26,"category_description":"\u7db2\u7ad9\u6700\u4f73\u5316\u8207\u6548\u80fd\u8abf\u6821\uff1aCore Web Vitals\u3001\u5feb\u53d6 (\u4f3a\u670d\u5668\/\u7269\u4ef6\/CDN)\u3001\u5716\u7247\u8207\u524d\u7aef\u8cc7\u6e90\u6700\u4f73\u5316\u3001Cloudflare \u5be6\u52d9\uff0c\u4ee5\u53ca WordPress\/PHP \u7248\u672c\u5347\u7d1a\u8207\u76f8\u5bb9\u6027\u6aa2\u67e5\u3002\u4ee5\u6578\u64da\u8207\u6d41\u7a0b\u8b93\u901f\u5ea6\u8207\u7a69\u5b9a\u5ea6\u540c\u6b65\u63d0\u5347\u3002","cat_name":"\u7db2\u7ad9\u6700\u4f73\u5316","category_nicename":"website-optimization","category_parent":85},{"term_id":223,"name":"\u7db2\u8def\u884c\u92b7\u6280\u5de7","slug":"marketing-tips","term_group":0,"term_taxonomy_id":223,"taxonomy":"category","description":"\u7db2\u8def\u884c\u92b7\u8207\u6210\u6548\u8ffd\u8e64\uff1aSEO\/GA4\/Search Console\u3001UTM \u8207\u53c3\u6578\u7ba1\u7406\u3001A\/B \u6e2c\u8a66\u3001Email\/\u81ea\u52d5\u5316 (FluentCRM\u3001OttoKit)\u3001\u793e\u7fa4\u8207\u5167\u5bb9\u884c\u92b7\u3002\u7528\u53ef\u843d\u5730\u7684\u7bc4\u672c\u63d0\u5347\u66dd\u5149\u8207\u8f49\u63db\u3002","parent":85,"count":10,"filter":"raw","cat_ID":223,"category_count":10,"category_description":"\u7db2\u8def\u884c\u92b7\u8207\u6210\u6548\u8ffd\u8e64\uff1aSEO\/GA4\/Search Console\u3001UTM \u8207\u53c3\u6578\u7ba1\u7406\u3001A\/B \u6e2c\u8a66\u3001Email\/\u81ea\u52d5\u5316 (FluentCRM\u3001OttoKit)\u3001\u793e\u7fa4\u8207\u5167\u5bb9\u884c\u92b7\u3002\u7528\u53ef\u843d\u5730\u7684\u7bc4\u672c\u63d0\u5347\u66dd\u5149\u8207\u8f49\u63db\u3002","cat_name":"\u7db2\u8def\u884c\u92b7\u6280\u5de7","category_nicename":"marketing-tips","category_parent":85}],"tag_info":[{"term_id":237,"name":"Amazon SES","slug":"amazon-ses","term_group":0,"term_taxonomy_id":237,"taxonomy":"post_tag","description":"","parent":0,"count":2,"filter":"raw"},{"term_id":298,"name":"AWS SES","slug":"aws-ses","term_group":0,"term_taxonomy_id":298,"taxonomy":"post_tag","description":"","parent":0,"count":2,"filter":"raw"},{"term_id":117,"name":"Domain Mailbox","slug":"domain-mailbox","term_group":0,"term_taxonomy_id":117,"taxonomy":"post_tag","description":"Domain Mailbox \u7db2\u57df\u90f5\u7bb1","parent":0,"count":3,"filter":"raw"},{"term_id":176,"name":"SSL","slug":"ssl","term_group":0,"term_taxonomy_id":176,"taxonomy":"post_tag","description":"SSL Secure Sockets Layer \u50b3\u8f38\u5c64\u5b89\u5168\u6027\u5354\u5b9a","parent":0,"count":3,"filter":"raw"},{"term_id":302,"name":"\u7db2\u57df\u7ba1\u7406","slug":"domain-management","term_group":0,"term_taxonomy_id":302,"taxonomy":"post_tag","description":"","parent":0,"count":4,"filter":"raw"},{"term_id":241,"name":"\u81ea\u52d5\u5316\u5de5\u4f5c\u6d41","slug":"%e8%87%aa%e5%8b%95%e5%8c%96%e5%b7%a5%e4%bd%9c%e6%b5%81","term_group":0,"term_taxonomy_id":241,"taxonomy":"post_tag","description":"","parent":0,"count":3,"filter":"raw"}],"_links":{"self":[{"href":"https:\/\/www.quantsnote.com\/en\/wp-json\/wp\/v2\/posts\/16517","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.quantsnote.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quantsnote.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quantsnote.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quantsnote.com\/en\/wp-json\/wp\/v2\/comments?post=16517"}],"version-history":[{"count":0,"href":"https:\/\/www.quantsnote.com\/en\/wp-json\/wp\/v2\/posts\/16517\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quantsnote.com\/en\/wp-json\/wp\/v2\/media\/16533"}],"wp:attachment":[{"href":"https:\/\/www.quantsnote.com\/en\/wp-json\/wp\/v2\/media?parent=16517"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quantsnote.com\/en\/wp-json\/wp\/v2\/categories?post=16517"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quantsnote.com\/en\/wp-json\/wp\/v2\/tags?post=16517"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}