Why should all URLs use HTTPS?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Your email goes out with a call-to-action linking to your site over HTTP instead of HTTPS. Most subscribers won't notice the URL scheme when they hover. But spam filters will, and so will the browser once they click through. In 2026, HTTP links in email are a deliverability and trust problem you don't need to carry.
HTTPS (HyperText Transfer Protocol Secure) encrypts the connection between a web server and a visitor's browser. For email senders, it matters in two places: the destination URLs you link to, and the tracking or redirect domains your ESP wraps your links with. Both need to use HTTPS. A link to http://yoursite.com/offer is a weak deliverability signal because spam has historically used unsecured URLs and shady redirect chains. Spam filters treat HTTP links as a small but real nudge toward the junk folder, even when your content is legitimate. Layer on browser warnings shown on non-HTTPS pages and you've added friction for every subscriber who clicks through.
The tracking domain issue trips people up more often than the destination URL issue. When your ESP wraps your links in click-tracking redirects, those redirects need to run on your own HTTPS-enabled custom tracking domain. Postmark and SendGrid both support custom HTTPS tracking domains, but you usually have to configure the SSL certificate yourself through your DNS provider. If your ESP's default tracking domain uses HTTP, every link in every email you send is going out unsecured, regardless of whether your destination pages use HTTPS. This belongs in the same category as your SPF, DKIM, and DMARC setup: foundational infrastructure that legitimate senders get right once and don't think about again.
The quickest audit: hover over links in a sent test email and check whether they start with https. If any don't, trace them back to either the destination page (needs an SSL certificate) or your ESP's tracking configuration. It's a one-time fix with lasting deliverability benefits, so it's worth doing properly rather than patching individual campaigns.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
