Custom tracking domains

A custom tracking domain keeps open, click, and unsubscribe URLs on a hostname you own, such as click.example.com. Configure it from Domains → your sending domain → Tracking domains. You can add more than one hostname and choose a different one for a campaign.

Use a dedicated subdomain. Do not reuse your website, MX host, or an existing CNAME. A hostname can have only one CNAME target.

Set it up in the UI

Add the hostname

Enter a full hostname such as click.example.com. Norbelys registers it for managed TLS and shows the exact DNS record it expects.

Publish the CNAME

Create click.example.com CNAME custom-track.generate-mcp.com. If your DNS provider supports Domain Connect, use Configure DNS automatically. Otherwise, the UI opens your provider and keeps the manual record visible with a copy button. Vercel DNS and Cloudflare are detected from the authoritative nameservers and get a direct dashboard button even when no Domain Connect template is available.

Wait for all three checks

Press Check DNS and TLS. The hostname becomes active only when the CNAME is exact, Cloudflare reports both the hostname and certificate as active, and the HTTPS health check succeeds. A DNS-only success is not enough.

Assign it

Enable Use for this domain, optionally make it the organization default, and choose it as this sending domain’s preferred tracker. Campaign Settings can override that choice and previews the resulting fallback chain before launch.

Which hostname a message uses

For each message, Norbelys resolves the first healthy, enabled option:

The campaign’s selected custom tracker.
The sending domain’s preferred tracker.
The organization’s default tracker.
track.norbelys.com.

The platform fallback is permanent. A pending, disabled, or degraded custom hostname does not stop sending and is never inserted into the message. Open pixels, click redirects, and unsubscribe URLs all use the same resolved hostname.

Security model

Every tracking token is signed and contains the exact hostname selected at send time. The tracking Worker rejects the token when it arrives on another host. Clicks can only resolve the destination already stored for that signed token; the custom hostname is not an open redirect. Legacy tokens remain valid only on track.norbelys.com.

Use the API

The same Domain resource powers the UI. There are no separate policy or tracking-settings endpoints.

Create a tracking-domain resource

curl --request POST https://api.norbelys.com/v1/domains \
  --header "Authorization: Bearer $NORBELYS_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{
    "capability": "tracking",
    "domain": "click.example.com",
    "tracking": {
      "assignedSendingDomainIds": ["dom_..."],
      "isOrganizationDefault": false
    }
  }'

Change assignments or defaults through the one Domain PATCH

curl --request PATCH https://api.norbelys.com/v1/domains/trk_... \
  --header "Authorization: Bearer $NORBELYS_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{
    "id": "trk_...",
    "version": 3,
    "tracking": {
      "assignedSendingDomainIds": ["dom_..."],
      "desiredState": "active",
      "isOrganizationDefault": true
    }
  }'

GET /v1/domains/{id} refreshes the DNS, managed-certificate, and HTTPS status for a tracking hostname. Repeated writes use the version field to prevent one browser or API client from silently overwriting another.

Troubleshooting

Status	What to check
Pending DNS	The hostname must resolve to exactly `custom-track.generate-mcp.com`; remove conflicting A, AAAA, or CNAME records.
Pending TLS	Keep the CNAME in place. Certificate issuance follows hostname validation and can take longer than DNS propagation.
Degraded	Confirm the CNAME still points to Norbelys, then run the check again. Sending uses the next fallback meanwhile.
HTTPS unhealthy	DNS and TLS may be valid while the origin health check fails. Keep the fallback enabled and contact support.

Norbelys serves these hostnames through Cloudflare for SaaS. Cloudflare documents the custom-hostname lifecycle and its hostname plan limits and pricing. The SaaS zone has one wildcard route to the tracking Worker. Creating or archiving a tracking domain only creates or removes its managed hostname and certificate; it never creates a Worker Route per customer.

Get started

Sending setup

Your audience

Campaigns

Inbox & results

AI & automation

Account & compliance

Custom tracking domains

Set it up in the UI

Which hostname a message uses

Security model

Use the API

Troubleshooting

​Set it up in the UI

​Which hostname a message uses

​Security model

​Use the API

​Troubleshooting

Set it up in the UI

Which hostname a message uses

Security model

Use the API

Troubleshooting