What happens if your CNAME isn’t verified?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
You've added a tracking CNAME to your DNS, your ESP says it's pending, and now you're wondering if anything is actually broken yet. Here's the honest answer: yes, something is probably already broken, and it's worth fixing before your next send.
When a CNAME isn't verified, the first thing that breaks is link tracking. Your ESP can't redirect clicks through your domain, so it either falls back to its own shared tracking domain or the links don't resolve at all. That fallback matters because a shared tracking domain carries reputation from every other sender on that platform. If someone else on that domain gets flagged, your links inherit the heat.
Open tracking pixels also fail. Images may not load. And if your CNAME points somewhere incorrect or nowhere at all, your click-through links will return an error to the reader. That's not just a metrics problem. That's a broken email.
The SSL angle is worth calling out separately. Most ESPs provision an HTTPS certificate for your tracking subdomain once the CNAME is verified. If it's not verified, that certificate doesn't exist yet. Subscribers on some clients or corporate networks may see a security warning when a tracked link redirects through an unsigned domain. Some security gateways will block those links entirely.
How to tell if yours is broken right now: send a test email to yourself and click every tracked link. If a link throws a certificate error, a 404, or redirects through a domain that isn't yours (like links.esp-shared.com instead of go.yourdomain.com), your CNAME isn't fully working. You can also paste the tracking subdomain into your browser and see if it resolves cleanly.
The fix is usually in your DNS settings. Check that the CNAME value matches exactly what your ESP gave you, with no trailing space or typo, and that DNS has had time to propagate (give it up to 48 hours). Most ESPs like Mailchimp, Klaviyo, or Brevo will show a green checkmark or "verified" status once they can see the record resolving correctly.
And this is worth sorting before sending. Broken tracking means corrupted data you can't recover, and if your links are broken for real subscribers, that's deliverability and trust damage you'll feel for more than just one campaign.
If you're not sure your DNS records are set up correctly, our free Email Header Analyzer can help you check what's actually happening with your links and authentication. Or if it's all gone sideways, reach out on the SOS hotline and we'll take a look.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
