SUPPORT.TWILIO.COM END OF LIFE NOTICE: This site, support.twilio.com, is scheduled to go End of Life on February 27, 2024. All Twilio Support content has been migrated to help.twilio.com, where you can continue to find helpful Support articles, API docs, and Twilio blog content, and escalate your issues to our Support team. We encourage you to update your bookmarks and begin using the new site today for all your Twilio Support needs.

Enabling SSL for Click and Open Tracking

Objective

Utilize HTTPS links for Click and Open Tracking in conjunction with Twilio SendGrid's Link Branding

Product

Twilio SendGrid

What is Click and Open Tracking? 

When click tracking is enabled on your account, SendGrid re-writes your links to add code to track clicks. Link brandings allow these links to be be re-written with your own domain instead of SendGrid's. For more information on link branding, click here.
When open tracking is enabled on your account, SendGrid adds an invisible pixel to your emails with a URL specific to that email. For more details on this, click here.

However, these URLs are over 'http' by default. As an additional layer of security, we allow these links to be re-written over 'https' by enabling SSL for click and open tracking. To ensure secure (HTTPS) tracking links, you can choose between Auto SSL (recommended) or Manual SSL.

Why Enable SSL?

In late October 2026, Gmail is rolling out security warnings for all non-HTTPS links. Enabling SSL prevents these warnings from appearing to your recipients, protecting your click-through rates and email reputation. A meaningful share of Gmail users already see these warnings today.

Option 1: Auto SSL (Recommended)

Twilio SendGrid now provides automatic SSL certificate provisioning through Cloudflare. This is a "set-and-forget" solution where SendGrid manages the entire certificate lifecycle—including provisioning and renewal—for you.

How to Enable Auto SSL

  1. In your SendGrid account, navigate to Settings > Sender Authentication > Link Branding.
  2. Start the setup flow for your branded domain.
  3. In the Advanced Settings section, check the box "Make link Auto SSL".
  4. During setup, you will be prompted to add two additional DNS records to your DNS provider:
    • _acme-challenge (CNAME): Acts as a permission slip for Cloudflare to automatically issue and renew the HTTPS certificate.
    • _cf-custom-hostname (TXT): A unique security code to verify domain ownership.
  5. Once DNS records are propagated (this can take up to 48 hours), verify the records in the SendGrid console. Once propagation is complete, Cloudflare typically issues the certificate within 15 minutes.

Using Auto SSL with Previously created Link Brandings

To maintain the same URL structure used with previous Link Brandings, follow the steps below

  1. Navigate to Settings > Sender Authentication > Link Branding in your SendGrid account.
  2. Locate your existing link branding configuration and take note of the assigned subdomain (e.g., url1234) See image below.
  3. Delete the existing link branding entry from the SendGrid console.
  4. Remove the existing link branding CNAME records from your DNS console. (Note that for the short time that there are no DNS records for this subdomain, previously sent links will not resolve.)
  5. Start a new setup flow for the same domain, selecting the options for Auto provision SSL certificate and Use custom link subdomain. See image below
  6. Input the original subdomain you noted in Step 2.
  7. Add the newly generated DNS records to your DNS provider.
  8. Return to the SendGrid console and click Verify.
  9. Once verified, all links previously sent using this link branding will resolve, and all newly generated links will automatically route over HTTPS.
Screenshot 2026-09-04 at 9.38.16 AM.png

Screenshot 2026-09-04 at 9.58.38 AM.png

Option 2: Manual SSL

If you require full control over your SSL certificates—such as managing them via your own CDN or load balancer—you can still provision them manually. This method is typically used by advanced users with custom infrastructure needs.

How to Enable Manual SSL

  1. Purchase and configure an SSL certificate through your preferred CDN or DNS provider.
  2. Complete the standard Link Branding setup in SendGrid.
  3. In your CDN, prepare a proxy for your branded domain that forwards traffic to sendgrid.net.
  4. Update your DNS CNAME records to point to your CDN proxy instead of SendGrid directly.
  5. Contact Twilio Support to finalize the manual enablement of HTTPS for your account.

Note: Manual provisioning requires ongoing maintenance, including the manual renewal and installation of certificates.

Using a Proxy

To prepare your account for SSL for click and open tracking using a proxy, please follow the following steps:

  • Prepare a proxy (like a web application, NGINX, or Amazon API Gateway) to take all traffic for mailing.example.com and transparently forward it to http://sendgrid.net or https://sendgrid.net. Example: When someone visits https://url1222.subdomain.edu, the proxy will transparently retrieve the content from https://sendgrid.net/some-tracking-link and send the result back to the user without their browser knowing it’s originally served by SendGrid.
  • Set up the proxy to use HTTP or HTTPS. For HTTPS, provide a valid SSL certificate for mailing.example.com domain.
  • To forward traffic, set the Host HTTP header to mailing.example.com domain. Explicitly set the Host header for the 1st record of the link branding domain only (Example: https://url1222.subdomain.edu) for all outgoing proxied requests to SendGrid.
  • Point the 1st CNAME record of the link branding record to your proxy. For example, CNAME mailing.example.com proxy.example.com.

In the steps above, mailing.example.com will need to be replaced with your actual link branding, and proxy.example.com will be replaced with your proxy. Once the steps above have been completed, please contact SendGrid Support to enable SSL click and open tracking on your account.

Using a CDN

If you prefer to use a CDN, this is entirely possible as well. Due to the numerous CDN providers out there, it's not possible for us to have setup steps for every single one of them; however, we do have instructions for CloudFlare, Fastly, and KeyCDN. Those steps can be found here. Once you've completed the applicable steps outlined in the article, please contact SendGrid Support to enable SSL click and open tracking on your account.

Important Considerations

  1. SSL Click Tracking does not automatically enable tracking on sub-user accounts. Sub-users must enable SSL Click Tracking separately within their own settings.
  2. DO NOT re-validate the DNS records within the SendGrid UI after completing the setup for proxy or CDN usage. Once your CNAME is updated to point to your proxy/CDN, a second validation in the UI will fail and break the authentication. If this occurs, you must:
    1. Update the DNS record for your link branding so that it points back to sendgrid.net
    2. Re-validate your link branding in the SendGrid UI
    3. Update the DNS record for your link branding once more so that it points to your proxy
  3. SSL for click tracking is an account-wide setting and cannot be enabled on a per-branded link basis. Consequently, ALL link brandings in your account must be prepped for SSL before the setting can be activated.

Running Our Checks on Your Own

Before enabling SSL for click and open tracking on your account, SendGrid has two checks that we run on our end. You can also run these checks on your own:

  1. Dig the CNAME record for the link branding. For Mac and Linux users, you can open terminal and enter the following command: dig mailing.example.com CNAME. You should see an "ANSWER SECTION" where the value does not return "sendgrid.net."
  2. Send a test email to yourself and check the links. Even if they are 'http', they should resolve over 'https' if you manually change the protocol in your browser address bar.

Since you're now passing a cert, the URL should resolve over 'https.' If ALL the link brandings in your account pass these two checks, your account is ready for SSL for click and open tracking to be enabled.

Have more questions? Submit a request
We can’t wait to see what you build.
Powered by Zendesk