Cold email tracking domain setup checklist

The campaign is ready. Copy is approved. Inboxes are connected. The sending tool shows the tracking domain as configured.

Then the first prospect clicks.

Instead of the client page, the browser shows a certificate warning. Or the link redirects through the wrong platform. Or the tracking host still points at the last tool the agency used. The campaign generated intent and the infrastructure lost it.

That is why tracking domain setup for cold email deserves its own launch checklist. A tracking domain is a small DNS record, but it touches link trust, click routing, SSL, reporting, and client signoff.

If you need a live one-domain check, start with the tracking domain checker. If you are checking the whole launch workspace, run the cold email domain checker first, then include every tracking host in the final launch QA pass.

What a tracking domain must prove

A cold email tracking domain should prove five things before links go live:

Requirement	Why it matters	OutboundQA check
Ownership	The host belongs to the client workspace, not a shared agency shortcut	Asset normalization and workspace mapping
DNS routing	The CNAME points to the expected sending tool target	Tracking CNAME and host resolution
HTTPS	The tracking host serves a valid certificate for that host	Tracking SSL and certificate identity
Redirect behavior	The click path reaches the expected handoff without unrelated hosts	Tracking redirect and HTTP status review
Launch evidence	The result is saved before the campaign starts	Client-ready report with verdict and fix notes

The sending tool can help with setup, but it should not be the only source of truth. The launch question is whether a prospect, browser, and link scanner can reach the tracking host safely from the outside.

1. Assign one tracking host per client workspace

Start with ownership. Agencies create risk when the same tracking domain is reused across clients or when one branded host is shared across unrelated campaigns.

Use a client-specific subdomain:

links.clientdomain.com
click.clientdomain.com
t.clientdomain.com

Avoid:

• The agency’s main domain.
• A root domain that should load the client’s website.
• One shared tracking host for every client.
• A hostname from an old sending platform.
• A platform default domain when the sender supports a custom host.

OutboundQA check: workspace asset mapping, duplicate detection, and tracking-domain classification.

Checklist row:

Item	Owner	Status	Notes
Tracking host belongs to the right client workspace	Ops lead	Ready / Needs Fix / Do Not Launch	Use one branded host per client setup

2. Copy the exact CNAME target from the sender

Most cold email tools provide a CNAME target after you add the tracking domain. Copy that target exactly. Do not reuse a value from another workspace, another tool, or an old internal checklist.

The record usually looks like this:

links.clientdomain.com  CNAME  track.sendingtool.example.

Check:

• The host is the exact subdomain used in campaign links.
• The record type is CNAME, not A.
• The CNAME target matches the sending tool for this workspace.
• The DNS provider did not append the root domain twice.
• No other record exists on the same host.

OutboundQA check: tracking CNAME presence, target capture, conflicting-record risk, and host resolution.

Manual tool: run the tracking domain checker after the record propagates.

3. Confirm the DNS record resolves publicly

The DNS record has to resolve outside the DNS provider dashboard. A saved record is not the same as a live record, and local resolver caches can hide mistakes.

Check:

• The tracking host returns a CNAME.
• The CNAME target resolves.
• The response is visible from public resolvers.
• There is no stale target from a prior sender.
• The host is not accidentally pointed at the client’s website server.

OutboundQA check: public DNS resolution and CNAME target validation.

Good DNS shape:

links.clientdomain.com
  CNAME track.sendingtool.example.

Bad DNS shape:

links.clientdomain.com
  A 203.0.113.10

An A record can work until the platform changes infrastructure. For tracking domains, use the CNAME target the sender gives you.

4. Wait for SSL provisioning before launch

This is the failure teams miss. The CNAME can be correct while SSL is still not ready.

Many sending tools provision a certificate only after the tracking host resolves to their target. That can take minutes. It can also take several hours. If the campaign launches in that gap, tracked links can show a browser warning.

Check:

• https://links.clientdomain.com opens without a certificate warning.
• The certificate is valid for the tracking host.
• The certificate is not expired.
• The certificate is not for the sending platform’s default domain only.
• The host does not downgrade to plain HTTP for tracked links.

OutboundQA check: tracking SSL, certificate validity, certificate identity, and HTTPS readiness.

Launch rule:

SSL result	Launch decision
Valid certificate for the tracking host	Ready
DNS resolves but SSL is still provisioning	Needs Fix
Certificate warning, expired certificate, or wrong host	Do Not Launch

5. Test the redirect path like a prospect

The tracking host exists to redirect clicks. DNS and SSL are only the first half. The final path still needs to behave cleanly.

Check:

• The tracking host returns a sensible HTTP status.
• The redirect chain is not unexpectedly long.
• The path does not pass through unrelated domains.
• The final campaign URL loads over HTTPS.
• The final URL belongs to the client or approved landing page.

OutboundQA check: tracking redirect behavior, HTTP status, launch note, and link-domain risk.

For a manual check, paste one real tracked test link into a browser before launch. Do not only open the root tracking host. The campaign link path is what prospects will hit.

6. Check blacklist and link-domain risk

Tracking domains appear inside the message body. That means URL and domain lists matter, even if SPF, DKIM, and DMARC are clean.

Check:

• The tracking host is not listed on URL-focused lists.
• The root domain is not carrying obvious blacklist risk.
• The final landing page domain is not listed.
• The sending platform default tracking domain is not being used by mistake.
• Inconclusive checks are recorded as unknown, not clean.

OutboundQA check: tracking-domain blacklist signals, domain blacklist signals, severity classification, and report notes.

Manual tool: use the email blacklist checker for the domain side, then include tracking hosts in the full launch QA report.

7. Match tracking setup to the campaign plan

Not every campaign uses tracking the same way. Some teams disable open tracking. Some keep click tracking and turn off open pixels. Some campaigns use untracked links because measurement is handled elsewhere.

The launch checklist should record the plan before the campaign starts.

Confirm:

• Whether open tracking is enabled.
• Whether click tracking is enabled.
• Which tracking host appears in rewritten links.
• Whether every sender in the workspace uses the same approved host.
• Whether unsubscribe and booking links are tracked or left direct.

OutboundQA check: launch-scope notes and report assumptions for Links checks.

This does not judge the marketing strategy. It makes the infrastructure decision visible so the account team does not debug the wrong thing after launch.

8. Recheck after DNS or sender changes

Tracking domains break during migrations. A client may move from one sending platform to another, rotate domains, change DNS hosts, or rebuild a campaign workspace. The old tracking CNAME can survive all of that.

Recheck after:

• Changing sending tools.
• Moving DNS providers.
• Reusing an old client workspace.
• Adding a new sending domain.
• Rotating campaign landing pages.
• Turning click tracking on after it was disabled.

OutboundQA check: daily monitoring during the launch window, status-change alerts, and recheck evidence after remediation.

Cold email tracking domain setup template

Use this table before a campaign starts sending.

Step	Launch question	Pass condition	OutboundQA check
Ownership	Is the tracking host assigned to the right client workspace?	One branded host per workspace or sending domain	Asset mapping and duplicate detection
CNAME	Does the host point to the sender’s expected target?	CNAME exists and target matches the workspace	Tracking CNAME
DNS	Does the tracking host resolve publicly?	CNAME target resolves from public DNS	Host resolution
SSL	Does HTTPS work without warnings?	Valid certificate for the tracking host	Tracking SSL
Redirect	Do tracked links hand off cleanly?	Expected status and redirect path	Redirect and HTTP status review
Blacklist	Is the link domain carrying visible launch risk?	No severe unresolved listing	Blacklist and severity classification
Campaign plan	Is tracking behavior documented?	Open, click, and direct-link choices are recorded	Report assumptions
Report	Can the team prove the result?	Verdict and fixes are saved before launch	Client-ready report

What this checklist does not prove

A tracking domain checklist does not prove inbox placement. It does not prove the copy is safe, the list is clean, or the sending volume is appropriate. It also does not replace SPF, DKIM, DMARC, MX, domain age, blacklist, or sender-requirement checks.

It proves something narrower: the link-tracking layer is configured, secure, and ready enough to include in launch signoff.

That narrow check matters. A cold email setup can pass authentication and still lose clicks because the tracking host has bad SSL. It can pass DNS and still route through the wrong platform. It can look clean in the sender and still create a client-facing launch blocker.

Use the tracking domain checker for a fast host-level pass. Use the cold email domain checker for the sending-domain side. For client work, put the tracking domain, sending domains, inboxes, and sender paths into one launch QA report, then share the sample report format before the campaign goes live.