--- title: "Email Link Branding Setup" slug: "email-link-branding-setup-1" description: "How to set up Link Branding in Insider One so email tracking links use your own domain instead of a third-party one." updated: 2026-08-26T14:31:36Z published: 2026-08-26T14:31:36Z canonical: "academy.insiderone.com/email-link-branding-setup-1" --- > ## Documentation Index > Fetch the complete documentation index at: https://academy.insiderone.com/llms.txt > Use this file to discover all available pages before exploring further. # Email Link Branding Setup Link branding, also known as using your own domain for email links, allows you to customize URLs to match your brand instead of using generic link shorteners. This process usually involves using your domain name for the links. Link branding aims to: - Make your links look professional and consistent with your brand to **enhance brand recognition** - Make your links look trustworthy to **increase trust** for users to click on them - Boost click-through rates and overall marketing performance to **improve marketing effectiveness** This article explains how the link branding setup process works and the following steps to complete the setup process: 1. [Add branded link](/docs/link-branding-setup#1-add-branded-link) 2. [Configure DNS records](/docs/link-branding-setup#2-configure-dns-records) 3. [SSL configuration](/docs/link-branding-setup#3-ssl-configuration) To start the link branding setup, select **Use Custom Branded Link** in the Branded Link Management step. ![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/image-1774443188869.png) > **Custom branded link (link branding)** Use your own domain for all email tracking links. **Example**: https://click.yourbrand.com/ > > **Default unbranded link** Use SendGrid’s generic tracking domain. **Example**: https://u123efe4.sendgrid.com/ ## 1. Add branded link In the first step of Branded Link Management, define your branded domain and the custom subdomain you want to add to your branded link. ![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/image-1774443647198.png) To create your branded link: 1. Select the domain you want to use in your branded link. 2. Add your custom subdomain (optional). 3. Click the **Confirm and Create** button. If you do not add a custom subdomain to your branded link, SendGrid will assign a subdomain value. Once you **confirm and create** your branded link, you **cannot** change the created link. ## 2. Configure DNS records The second step of link branding setup is to [configure the DNS records](https://academy.insiderone.com/docs/configure-dns-settings-for-email) for your branded domain. DNS records are used to prove that you own the domain you want to use for link branding. By adding the DNS records provided in this step, you authorize Insider One to generate and serve tracking links on behalf of your domain. | Type | Host | Value | | --- | --- | --- | | CNAME | yourdomain.com | sendgrid.net | | CNAME | url123.your-domain.com | 24584.sendgrid.net | > **Suggested reading**: [Automatic DNS Records Configuration](https://academy.insiderone.com/docs/automatic-dns-records-configuration) ## 3. SSL configuration In the SSL Configuration step, you will secure your branded link domain with an SSL certificate. SSL ensures that all tracking links load over HTTPS, improving trust and preventing security warnings in email clients and browsers. If your CNAME points directly to sendgrid.net with no CDN, proxy, or API Gateway in between, SendGrid handles SSL automatically, and your link branding setup is complete after step 2. The SSL configuration below applies only if your branded link domain is behind a CDN, proxy, or API Gateway. Some domains either use a **CDN** or **proxy provider** (such as Cloudflare, Akamai, Fastly, or similar services) to manage traffic, caching, and security. While configuring SSL for your branded link, you need to select how you manage your domain routing: - The domain is managed through a **CDN**. - The domain is managed through a **proxy** or an **API Gateway**. ![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/image-1774444758488.png) The diagram below shows a case where SSL termination occurs on a customer-managed infrastructure, not in SendGrid. The Host header must carry the branded domain when forwarding to sendgrid.net. ![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/image-20260531-125611.png) ### If your domain is managed through a CDN #### 1. Check your SSL certificate Your SSL must cover the exact branded link you plan to use. You can meet this requirement in two ways: - Using a wildcard certificate (e.g., *.yourdomain.com) for single-level subdomains - Using a specific certificate issued directly for your branded link domain If your certificate does not cover the branded link domain, you must purchase it or generate a new certificate that includes this domain. You can follow the documentation for some common providers: - [AWS Route53](https://www.youtube.com/watch?v=ookzXuMr8eY) - [Google Domains](https://www.youtube.com/watch?v=245ZJLm1AV4&t=1477s) - [GoDaddy (CPanel)](https://www.youtube.com/watch?v=h-CN_JVi0kU) - [Azure](https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate?tabs=apex) #### 2. Forward all requests to SendGrid Configure your CDN to forward all traffic from your branded link to sendgrid.net. If you use Azure CDN, set your branded domain as the **Origin Host Header** in your CDN profile. You can follow the documents for some common providers: - [Cloudfront](https://support.sendgrid.com/hc/en-us/articles/4412701748891-How-to-configure-SSL-for-click-tracking-using-CloudFront) - [Cloudflare](https://www.twilio.com/docs/sendgrid/ui/sending-email/content-delivery-networks/using-cloudflare-as-your-content-delivery-network-cdn) - [Fastly](https://www.twilio.com/docs/sendgrid/ui/sending-email/content-delivery-networks/using-fastly-as-your-content-delivery-network-cdn) - [KeyCDN](https://www.twilio.com/docs/sendgrid/ui/sending-email/content-delivery-networks/using-keycdn-as-your-content-delivery-network-cdn) #### 3. Update your DNS record Update the CNAME record and its respective CNAME value in your DNS host provider for your branded link domain. Once configured, return to this page and click the **Check SSL** button to complete your SSL setup check. | Type | Host | Value | | --- | --- | --- | | CNAME | http://url123.yourdomain.com | URL to your CDN | Make sure **not** to validate the DNS record **more than once**. If you change the CNAME record and attempt a second validation, it will fail, and authentication will stop working. ### If your domain is managed through a proxy or API Gateway #### 1. Check your SSL certificate Your SSL must cover the exact branded link you plan to use. You can meet this requirement in two ways: - Using a wildcard certificate (e.g., *.yourdomain.com) for single-level subdomains - Using a specific certificate issued directly for your branded link domain If your certificate does not cover the branded link domain, you must purchase it or generate a new certificate that includes this domain. You can follow the documentation for some common providers: - [AWS Route53](https://www.youtube.com/watch?v=ookzXuMr8eY) - [Google Domains](https://www.youtube.com/watch?v=245ZJLm1AV4&t=1477s) - [GoDaddy (CPanel)](https://www.youtube.com/watch?v=h-CN_JVi0kU) - [Azure](https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate?tabs=apex) #### 2. Forward all requests to SendGrid Configure your proxy/API Gateway to forward all traffic from your branded link to **sendgrid.net**. - If you're using a Proxy, follow [SendGrid’s custom SSL proxy steps](https://www.twilio.com/docs/sendgrid/ui/account-and-settings/custom-ssl-configurations). - For an API Gateway, forward the request to **sendgrid.net** and use your branded domain as the HTTP host header. You can also refer to [NGINX](https://gist.github.com/omermevlut/23de878d274eade0580ec93efb95fcf4). - For Google Cloud Platform setups, see the [Advanced: Google Cloud Setup for Link Branding SSL](https://academy.insiderone.com/docs/advanced-google-cloud-setup-for-link-branding-ssl) guide. #### 3. Update your DNS record Update the CNAME record and its respective CNAME value in your DNS host provider for your branded link domain. Once configured, return to this page and click the **Check SSL** button to complete your SSL setup check. | Type | Host | Value | | --- | --- | --- | | CNAME | http://url123.yourdomain.com | URL to your Proxy or API Gateway | Make sure **not** to validate the DNS record **more than once**. If you change the CNAME record and attempt a second validation, it will fail, and authentication will stop working. ### Verify SSL setup After configuring SSL for either CDN, Proxy, or API Gateway, you will need to verify your SSL setup. Below, you will see the Check SSL Setup section as **Pending**. To verify your setup, click the **Check SSL** button. ![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/image-1774445647839.png) If verified, your link branding setup is complete. If the verification fails, you can contact the Insider One team for support. If you want to manually test your SSL setup, you can run the following command: ```none openssl s_client -showcerts -connect url{rand-id}.{yourdomain}.com:443 // or openssl s_client -showcerts -connect {subdomain}.{yourdomain}.com:443 ``` You will receive a public certificate as a response with the following: ![](https://cdn.document360.io/c6df4583-da94-4cb2-bb8a-be0cbdd11109/Images/Documentation/unnamed%20(99)(1)(1).png) Once you verify everything on your end, you can contact the Insider One team for verification. Once Insider One verifies the setup, your next email will include your custom domain in the links instead of **sendgrid.net**. ## Related - [Email Universal Link Setup](/email-universal-link-setup.md)