HTTPS click tracking

Tracking links are http:// by default. SES uses HttpsPolicy OPTIONAL, and the CNAME target is r.us-east-1.awstrack.me. For https:// links, put CloudFront in front of SES's tracking endpoint. setup-aws.mjs does not create this.

1. Request an ACM certificate in us-east-1 for the tracking host (for example links.example.com) and add its validation CNAME.

2. Create a CloudFront distribution:

   • Origin: r.us-east-1.awstrack.me, HTTPS only.
   • Alias: your tracking host, with the certificate.
   • Cache policy: Managed-CachingDisabled.
   • Origin request policy: Managed-AllViewer. SES needs the viewer's Host header.

3. Set TRACKING_CNAME_TARGET=<id>.cloudfront.net and TRACKING_HTTPS=REQUIRE. Then set the domain's tracking_subdomain and point its CNAME at the distribution.

4. Check:

   Copy Text

   curl --head https://links.example.com/favicon.ico

   The response should include x-amz-ses-request-protocol: https.

Set TRACKING_HTTPS=REQUIRE only when the target really serves https.