Custom Tracking Domains for Cold Email: Setup and Real Risks

A custom tracking domain is a subdomain you own, such as track.yourdomain.com, pointed by CNAME at your cold email tool's tracking server. Open pixels and rewritten links then show your domain instead of a hostname shared by every customer of that tool. It removes one shared-reputation risk. It does not make open tracking accurate, and it does not protect you from your own sending.

This post covers what the record does, the exact setup each major tool documents, the HTTPS detail that breaks links, and whether you should track opens at all. For the rest of a cold email domain build (SPF, DKIM, DMARC, redirects, inbox counts), see setting up secondary domains for cold email.

What tracking actually puts in your email

Open and click tracking work by adding URLs on the tool's domain to your message. Open tracking inserts a tiny remote image. When the recipient's mail client loads it, the tool logs an open. Click tracking rewrites each link so it goes through the tool's server first, which logs the click and redirects to the real destination.

Both mean your message contains a domain you did not choose. On a default setup that is the tool's shared tracking hostname, used by every customer who has not set up their own. Smartlead's help centre puts the concern plainly: "Shared tracking URLs across thousands of campaigns can negatively impact deliverability."

Why a shared tracking domain is a risk

Mailbox providers and blocklists judge the domains inside a message, not just the one in the From line. Spamhaus says its Domain Blocklist should be applied "during content inspection - by looking up domains appearing in the mail headers and body e.g., URLs or contact email addresses." So the reputation of every link domain in your email counts.

A shared tracking hostname is in the body of mail from every customer who has not replaced it, including the ones sending to scraped lists. You inherit whatever that traffic earns. Spamhaus even has a return code for this kind of domain: 127.0.1.103, an "abused spammed redirector domain". Click tracking is a redirector by design.

A custom tracking domain swaps that shared hostname for one only your mail uses. Instantly's help article describes it as a proxy "isolating your sender reputation from others." lemlist's setup guide says it separates "your tracking reputation from other senders", and adds that a custom tracking domain "is now required to send with tracking enabled" on lemlist.

The records each tool documents

Every tool uses a CNAME from a subdomain you choose to a hostname it runs. Here is what each vendor's help centre specified when we checked on 7 October 2026:

Tool	CNAME host (example)	Points to	Extra record	Stated propagation
Instantly	inst	prox.itrackly.com	None	"24-72 hours (often faster)"
lemlist	trail, route or lemtrail (shown in app)	Shown in app, "commonly custom.lemlist.com"	TXT at @ with a value lemlist generates	Not stated
Smartlead	emailtracking	open.sleadtrack.com	None	"30 mins to 24 hour"

The setup is the same shape in all three:

1. Add the CNAME at your DNS host for the domain you send from.
2. Enter the full hostname (for example inst.yourdomain.com) in the tool's account or domain settings.
3. Verify. Instantly has a Check Status button. Smartlead's Verify CNAME button opens an nslookup.io page, where the canonical name should read open.sleadtrack.com.

You can confirm the record yourself before clicking verify:

dig +short CNAME inst.yourdomain.com

It should return the vendor hostname with a trailing dot. If it returns nothing, the record has not propagated or was created on the wrong domain. The most common mistake is typing the full hostname into the DNS host field, which creates inst.yourdomain.com.yourdomain.com.

If your DNS is on Cloudflare

Set the tracking CNAME to "DNS only", not proxied. lemlist's guide says to click the orange cloud so the record is "DNS only (not proxied)." With the proxy on, a dig CNAME lookup will not return the vendor hostname, so a quick way to catch this mistake is the check above.

The HTTPS catch

Your tracking subdomain needs a valid TLS certificate, and the tool, not you, usually issues it. A link in a 2026 email that points at plain http:// or at a hostname with a broken certificate gets a browser warning, which is worse than no tracking at all.

lemlist's guide names a specific failure: "Your domain's CAA records may block Let's Encrypt (used for issuing certificates)." A CAA record lists which certificate authorities may issue for your domain. If you have one that names only your main CA, add letsencrypt.org so lemlist can get a certificate for the tracking subdomain. Check what you have:

dig +short CAA yourdomain.com

No output means no CAA restriction, and any authority may issue. Instantly's and Smartlead's setup articles do not discuss certificates, so after setup, click a tracked link from a test email and confirm it loads over https:// without a warning.

Should you track opens at all?

For cold email, open tracking now costs more than it tells you. Two primary sources explain why.

Apple's Mail app has a privacy setting, Protect Mail Activity. Apple's Mail documentation says it will "privately download remote content in the background when a message is received (instead of when you view it)", which "prevents senders from collecting information when you view a message, such as when and how many times you view it". Apple's privacy overview says the download happens "regardless of whether you engage with the email." For recipients with this setting on, an "open" means the message arrived, not that anyone read it.

Google's sender guidelines say: "Google doesn't track open rates. Google can't verify the accuracy of open rates reported by third parties. Low open rates aren't necessarily an accurate indicator of deliverability or spam classification issues."

So the number is inflated at one end and not what Gmail uses at the other. Meanwhile the pixel adds an extra remote image to a plain-text-style cold message, and every rewritten link adds a redirect hop. Many cold email senders track replies only, and leave click tracking on only where they genuinely need to know which link worked.

If you keep tracking on, a custom tracking domain is the minimum. If you turn it off, you do not need one.

What a custom tracking domain does not fix

It separates you from other customers of the same tool, not from the consequences of your own list. The tracking subdomain lives under your domain. If your domain gets listed on the Spamhaus DBL because of complaints or trap hits, the listing now appears twice in every message: in the From address and in every tracked link. Our explainer on Spamhaus listings covers what each list means.

Bounces are part of the same picture. Mailing addresses that do not exist is one of the clearest signals of a scraped or stale list, which is exactly the behaviour domain blocklists react to. Verifying a lead list before it goes into the sequencer removes the invalid addresses and flags catch-all domains as risky; you can test a single address with the free email checker. See why cold emails bounce for the common causes.

Checklist

1. Decide whether you need open tracking at all. If not, turn it off and skip the rest.
2. Use a custom tracking subdomain on each sending domain where tracking stays on.
3. Copy the CNAME exactly from your tool's help centre or app, and verify it with dig.
4. On Cloudflare, set the record to DNS only.
5. Check CAA records allow your tool's certificate authority, then click a tracked link to confirm HTTPS works.
6. Check the domain against blocklists occasionally with the blacklist check, since tracked links carry your domain's reputation with them.