Tracking Domains and SSL: Setup, Rotation and Hygiene

Why use your own domain

A tracking link on a shared or technical domain works, but it is a risk you do not control. If an ad platform or a browser flags that domain because of someone else's campaigns, your links suffer too. Your own domain separates your reputation from everyone else's, looks more trustworthy in the ad preview, and can be swapped when needed.

Connecting a domain

Use a subdomain of a domain you own, such as go.example.com or track.example.com. The root domain can keep serving your site. The usual steps:

1. Add the hostname in the tracker.
2. Create the DNS records the tracker shows: usually a CNAME that points the subdomain to the tracker, and a TXT record that proves you own it.
3. Wait for DNS to propagate. It is often minutes, sometimes hours.
4. Verify the domain in the tracker and set it as the campaign's tracking domain.

HTTPS without surprises

Every tracking link should be HTTPS. Ad platforms reject or downgrade plain HTTP, and browsers warn visitors. Modern trackers issue and renew certificates for connected domains automatically. What breaks renewal:

• The DNS record was changed or deleted after verification.
• A CAA record on the root domain does not allow the certificate authority the tracker uses.
• The domain expired at the registrar. Turn on auto-renew for every domain that carries live traffic.

Rotation and spare domains

Keep at least one verified spare domain per active vertical. When a domain gets flagged, you switch the campaign to the spare and update the ads, instead of waiting for DNS and certificates under pressure.

• Use domain pools if your tracker has them, so a campaign can move to a healthy domain without manual edits.
• Age spare domains a little: a domain registered an hour ago looks suspicious to some reviewers.
• Do not chain many redirects across domains. Each hop adds latency and a point of failure.

Domain hygiene

• One purpose per domain. Do not mix tracking links, landing pages for different verticals and email links on one hostname.
• Neutral names. A domain that spells out the offer or the vertical invites scrutiny.
• A real root page. Someone will open the root domain. Show a simple, honest page instead of an error.
• Watch health. Check regularly that each domain resolves, has a valid certificate and is not on public blocklists.