How do CNAME or tracking domain errors trigger bounces?

You send a campaign, links look fine in the preview, and then bounce reports start coming in. Before you blame your list, check your tracking domain. A broken CNAME is one of the more confusing causes of delivery problems because the email itself is perfectly valid. The problem lives in the infrastructure wrapped around it.

Here's how this works at the ESP level. When you enable click tracking, your ESP rewrites every link in your email so it points to a redirect URL on their servers. To keep that redirect on your own branded domain (clicks.yourdomain.com instead of clicks.mailchimp.com), you create a CNAME record in your DNS that points your subdomain at the ESP's tracking endpoint. That's the tracking domain.

When that CNAME breaks, a few bad things can happen at the same time.

First, the links inside your email stop resolving. Recipients click and get an error, but more importantly, some spam filters and security gateways scan link destinations before the email even reaches the inbox. If a link in your email points to a domain that doesn't resolve, the filter can flag the whole message as suspicious or block it outright. That's how a DNS config problem turns into a deliverability problem.

Second, certain receiving servers run pre-delivery checks on hostnames found in the email body. An unresolvable hostname in a link can trigger a rejection that looks like a DNS-related bounce even though your sending domain is completely healthy.

So the most common CNAME failure modes are these four. The CNAME was never created (someone forgot a step during ESP setup). The CNAME was deleted during a DNS migration. The ESP changed their tracking endpoint URL and your old CNAME now points at nothing. Or the SSL certificate on your tracking subdomain expired or was issued for the wrong hostname, so HTTPS links fail with a certificate mismatch error.

That last one is subtle. The CNAME itself may technically resolve, but because the SSL handshake fails, security scanners treat the domain as broken anyway.

To diagnose this, open a terminal and run dig clicks.yourdomain.com CNAME (or use an online DNS lookup tool). You should see it resolve cleanly to your ESP's tracking endpoint. Then copy one of your tracked links from a recent campaign and paste it into your browser. If it errors or throws a cert warning, you've found the problem.

If you're not sure where to start, our free Email Header Analyzer can help you pull apart what's happening at the delivery layer. Or if this is actively causing problems right now, the SOS hotline is free and we'll walk through it with you.