Every sender who turns on click tracking makes a quiet trade, whether they realize it or not: the platform gets to count clicks, and a spam filter gets one more thing to judge. Configured well, the trade costs nothing. Left on the defaults most platforms ship, it becomes one of the most common hidden reasons clean, authenticated mail still ends up in spam. And the redirect itself was never the problem. What matters is the domain behind it, how many hops it takes, and whether that domain matches the rest of your email.
The stakes are easy to underestimate. In our own data, more than one email in five we check contains at least one broken link, and a surprising share of those breaks live in the tracking redirect rather than the visible URL. Only 14% of senders pass the one-click List-Unsubscribe check, and that header is really just a link that behaves. So this guide takes the long way through the subject: how tracking actually works, the specific ways it trips filters, the branded tracking domain that fixes almost all of it, and how to test a real send before it goes out.
What link tracking is and how it works
When you turn on click tracking, your platform does not leave your links alone. It rewrites every href to point at its own tracking domain, with the real destination encoded in the URL. A link that reads https://yourbrand.com/sale in the email body actually points at something like this:
<a href="https://trk.klclick.com/CL0/https://yourbrand.com/sale/1/abc123...">
Shop the sale
</a>
When the subscriber clicks, the request hits the tracking domain first. The platform logs the click, then issues an HTTP 302 redirect to the real destination. The reader lands on your page a few milliseconds later and never sees the detour. Open tracking works the same way with a different mechanism: a 1x1 transparent pixel image is embedded in the message, and when the email loads that image, the request records an open.
Which means a tracked email always carries two inspectable artifacts: links that resolve through a redirect domain, and a remote image that phones home when the message opens. Neither is suspicious on its own; filters see both billions of times a day. Everything depends on whose domain that redirect runs through, and how well it holds up.
Does link tracking hurt deliverability?
Here is the honest version, without the hedging most articles wrap around it: tracking as a concept does not hurt deliverability, and the default configuration usually does. Mailbox providers expect redirects and process billions of tracked links a day; a well-implemented one is close to invisible. Execution is where senders get hurt.
Remember that filters score every domain that appears in a message, not just the one you send from, and the domain your links redirect through is very much on that list. Let it be shared, mismatched, chained, or broken, and the tracking layer turns into the weakest point of an otherwise strong send. The whole message pays for it.
A filter does not stop at your From address. It follows your links, and it judges you by where they lead.
The five ways tracking links trip spam filters
1. Shared tracking domains you do not control
By default most platforms route your links through a shared tracking domain used by every other customer on the plan. Klaviyo uses trk.klclick.com, SendGrid uses ct.sendgrid.net, ActiveCampaign uses activehosted.com, HubSpot uses hubspotlinks.com, and Mailchimp rewrites links through usX.list-manage.com. Sharing that domain means sharing its reputation with thousands of senders you have never met, and some of them send far worse mail than you do. The day one of them gets the domain flagged, your links inherit the flag, and nothing about your own behavior changes that math.
A few of these shared domains carry a documented history of phishing abuse, for the simple reason that attackers love hiding a malicious destination behind a trusted redirector. That history does not stay with the attacker. It follows every legitimate sender still on the domain.
2. A link domain that does not match your From domain
Phishing has one signature move: the message claims to be one brand while the links quietly go somewhere else. Filters have been trained on that pattern for years. So when your mail says it is from yourbrand.com but every link points at trk.klclick.com, you are presenting the exact silhouette they learned to distrust, however legitimate you are. Align the links with your own domain and the signal simply disappears.
3. Redirect chains and URL shorteners
Each extra hop reads as one more attempt to hide where a link really goes. A tracking redirect that points at a bit.ly link that points at yet another redirect before reaching your page looks, to a filter, like a chain built to obscure the destination, because that is exactly how real phishing behaves. Public URL shorteners raise suspicion all by themselves; stacked on top of tracking redirects, they compound it. One hop, tracking domain straight to destination, over HTTPS, nothing in between.
4. Broken and expired tracking links
A tracking link that errors out, points at a dead redirect, or has quietly expired is worse than no tracking at all: readers hit a wall, and filters read broken links as a statement about your quality control. It happens far more than senders assume. About 22% of the emails we check contain at least one broken link, and tracking redirects are a frequent culprit precisely because they add a layer that can fail independently of the real URL.
5. Insecure (HTTP) tracking links
Plain HTTP on a tracking link gets flagged as insecure by modern filters and browsers alike, and it quietly undercuts whatever trust your authentication earned. Every link should resolve over HTTPS, tracked or not. Most platforms handle this correctly now; custom setups and older templates are where it still slips through, so spend the minute confirming.
Security gateways: the corporate inbox problem
There is a sixth failure mode, and it singles out business recipients. Enterprise security gateways like Microsoft Defender for Office 365, Proofpoint, and Mimecast rewrite and pre-scan links, following every URL in a message before the recipient ever clicks. When your links route through a shared tracking domain that any of these gateways distrusts, the whole message can be quarantined after your platform reports it as sent. You see clean delivery to Gmail and Yahoo, then silence from corporate domains. The trigger is almost never your authentication, which passes; it is the shared link domain. Senders hit this most on platforms that wrap links through a shared redirector, and the fix is the same one that solves the consumer-inbox problems: move your links onto your own domain. For the platform-specific version of this, see the ActiveCampaign and HubSpot deliverability guides.
Open tracking, the pixel, and Apple Mail Privacy Protection
Open tracking costs less deliverability than click tracking, but it sets its own trap. The 1x1 pixel is a remote image request, and a message that is mostly images with a lone tracking pixel and little live text drifts toward the profile filters distrust. These days, though, the bigger problem is measurement rather than placement. Ever since Apple Mail Privacy Protection launched, Apple pre-loads the pixel on delivery for its users, logging an open whether or not a human ever read the message. A large share of opens now comes from Apple, so open rates run inflated across most lists.
Anything you automated on top of opens breaks with it. Engagement segments fill with people who never actually read you, and sunset flows meant to suppress non-openers stop firing when they should. Move your engagement and suppression rules onto clicks and real on-site behavior, which are far harder to fake, and demote opens to a soft directional signal. Our guide to email engagement metrics sorts out which signals still mean something.
Shared versus branded tracking domain
A branded tracking domain (you will also see it called a custom tracking domain or custom link domain) is nothing more exotic than a subdomain of your own domain pointed at your platform, so links resolve through links.yourbrand.com instead of trk.klclick.com. For something so small, it is the single most effective tracking-related deliverability fix available, and the comparison is not close.
| Factor | Shared tracking domain | Branded tracking domain |
|---|---|---|
| Reputation | Shared with thousands of unknown senders | Yours alone, tied to your own domain |
| Alignment with From domain | Mismatched, reads as phishing-adjacent | Aligned, one consistent domain |
| Blocklist exposure | Inherits any listing the pool earns | Only your own behavior affects it |
| Phishing-abuse history | Carries the shared domain's past | Clean, starts from your reputation |
| Control | None, the platform manages it | You own the DNS record |
How to set up a branded tracking domain
Setup is a single DNS record on most platforms. You create a subdomain, add a CNAME record pointing it at the value your platform gives you, then enable the custom domain in the platform. For Klaviyo, for example, you publish a CNAME like this and connect it under the click tracking settings:
links.yourbrand.com. CNAME dct.klaviyodns.com.
Pick whatever subdomain you like; links, trk, email, and click are all common, and the choice is purely cosmetic. The part that matters is that it lives under your own registered domain, so it aligns with your From domain. Here is where the default shared domain sits on the major platforms, and whether a branded option exists:
| Platform | Default shared domain | Branded tracking domain |
|---|---|---|
| Klaviyo | trk.klclick.com | Yes, CNAME to dct.klaviyodns.com (paid) |
| SendGrid | ct.sendgrid.net | Yes, brand a link subdomain |
| ActiveCampaign | activehosted.com | Yes, on higher-tier plans |
| HubSpot | hubspotlinks.com | Yes, set a Click tracking domain |
| Mailchimp | usX.list-manage.com | No custom link domain for standard sends |
| Amazon SES | None by default | Bring your own tracking or a configuration set |
Two platform quirks are worth knowing before you lean on that table. Mailchimp offers no custom link-tracking domain for standard campaigns (only its separate Transactional product does), which makes a strict business audience a genuine constraint there. Amazon SES sits at the other extreme: it does not rewrite links at all until you add open and click tracking through a configuration set, so SES senders start from the lowest-risk default and take on tracking-domain risk only by choice.
When to turn link tracking off
Not every message should carry tracking at all. On transactional and security mail it can actively break things, and the mechanism is mundane: password resets, email verification, and magic-login links are single-use by design, while corporate security scanners follow every link in a message before the recipient gets the chance. Let a scanner pre-click a one-time link wrapped in a tracking redirect and it may consume or expire it. The real user then lands on a dead link, unable to reset their password, and files the experience under "your product is broken."
For that reason, turn click tracking off on password resets, verification, and other one-time-use links, or make sure those links tolerate being fetched more than once. The analytics you lose on a password-reset email are worthless anyway, and the failed logins you prevent are not. Keep tracking where it earns its keep, on marketing campaigns where click data drives real decisions, and drop it where it only adds risk.
How to test whether your tracking links hurt deliverability
Your platform's reporting cannot answer this question; it shows you the send, never how a real inbox treated it. So test the actual message:
- Send a real campaign to a seed address from a free spam test or an inbox placement test, using your normal sending path so the links are wrapped exactly as a subscriber would receive them.
- Inspect the wrapped links in the delivered message. Confirm the tracking domain is a subdomain of your own domain, not a shared one, and that each link resolves in a single HTTPS hop with no shortener in the chain.
- Check for broken links, which the spam test flags, and confirm no link returns an error or an insecure warning.
- Read placement per provider. If Gmail and Yahoo are clean but corporate domains filter you, the shared link domain is the prime suspect.
An email heatmap then shows whether readers actually reach and click your links once placement is solved, and deliverability monitoring watches for the reputation drift that a bad tracking domain causes over time. For the content side of the same problem, the spam word checker catches copy that compounds link risk.
The link tracking deliverability checklist
- Route click and open tracking through a branded tracking domain on your own domain
- Confirm your link domain matches your From domain (both under yourbrand.com)
- Keep every link to a single HTTPS hop, no URL shorteners in the chain
- Fix broken and expired tracking links before every send
- Turn off click tracking on password resets, verification, and one-time-use links
- Base engagement and sunset rules on clicks and on-site behavior, not opens
- Test a real send to a seed inbox and inspect the wrapped links per provider
Keep the tracking. Click data tells you what your audience actually cares about, and it is one of the few engagement signals Apple's privacy changes have not corrupted. The goal was never to strip tracking out; it is to make it look like what it honestly is, your own domain sending your own subscribers to your own pages. Get the tracking domain right and the rest of your deliverability work stops leaking away through your links. Curious how your next campaign's links hold up? Run a free spam test and read the result in about 30 seconds, no signup required.
