Mailgun supports enabling the HTTPS protocol on open, click and unsubscribe tracking URLs. Mailgun utilizes Let’s Encrypt with HTTP-01 challenges via your existing tracking CNAME record to issue a TLS certificate. This configuration also supports HTTP Strict Transport Security (HSTS).

**Note: one-click HTTPS tracking links are available on all subscription plans. The Flex plan, which is a pay-as-you-grow usage-based plan, does not include this feature.  If your account is using the Flex plan, please see the "CDN Alternative" section below.

Setup

Tracking CNAME

You must first ensure that you have a tracking CNAME in place pointing to mailgun.org or eu.mailgun.org if your domain is in our EU infrastructure. By default, the DNS record is "email.<domain.com>", however, the tracking hostname is configurable via the Mailgun application, so just be sure the hostname in your CNAME record matches the tracking hostname set.

Once your CNAME record is in place, head to Sending > Domain settings (ensure you've selected the domain you wish to change) and then navigate to the Tracking section and click on the Edit button next to Tracking protocol and change the radio button from HTTP to HTTPS and hit Save. This will kick off a 2 step process; first, we'll generate a Let's Encrypt TLS certificate for your tracking domain, and then we'll switch the protocol for your URLs from HTTP to HTTPS. Give it a few moments to complete and then you're all set!

Cloudflare Proxy

If you are using Cloudflare to manage your DNS, you will need to turn off Cloudflare’s proxy for your CNAME record and ensure it's set to DNS only as we use the record to generate the certificate, to renew the certificate, and to terminate TLS every time an HTTPS link is clicked.

CDN solution

If you were previously using the alternative solution using a 3rd party CDN (See "CDN Alternative" section at the bottom of this article), you’ll need to ensure you update your CNAME record, and then head to domain settings and switch your domain from HTTPS > HTTP and then back to HTTPS so that we can generate a TLS certificate for your tracking domain.

FAQ

What happens to my existing HTTP links that were generated prior to enabling HTTPS?

Our servers will still listen on port 80 so previous tracking links utilizing HTTP will still work.

What happens to my existing links if HTTPS is disabled?

We retain the generated certificate, so the links will still be valid.

Will Mailgun rotate the SSL certificates when required?

Yes, the certificates will be auto-renewed every 60 days, as per the Let's Encrypt recommendation.

CDN Alternative

Note: this alternative is only needed if you are on the Flex plan, which is a pay-as-you-grow usage-based plan. If you are on any subscription plan, please use the solution we provide above.

Why Do I Need a CDN?

To understand why the use of a CDN is required for HTTPS tracking links, here's a quick, high-level overview of how they work is needed.

Tracking links work by utilizing a CNAME that points to mailgun.org.  Links in your email messages are then rewritten with this tracking hostname.  When your recipients then click on those links, it first sends the request to mailgun.org, and we return a redirect to the original URL.

Since we do not support HTTPS connections to mailgun.org, a CDN is needed to fill the gap between the client and mailgun.org. Essentially, the client connects to the CDN via HTTPS, the CDN connects to mailgun.org via HTTP, and the CDN relays the response from mailgun.org to the client over HTTPS.

The following are the specific steps for setting up CloudFlare as a CDN to handle Mailgun tracking links to support HTTPS.

Step 1: Create A CNAME

In your CloudFlare account:

• Click on the DNS option and configure a new CNAME entry that points your Mailgun Tracking CNAME (e.g., email.your-domain.com) to mailgun.org. Ensure that the CNAME is configured as HTTP Proxy (CDN), which means that the cloud image under Status should be the color orange.

Step 2: Create A Page Rule

Also in your CloudFlare account:

• Navigate to the Page Rules settings for your domain and create a Page Rule for your Tracking CNAME (i.e., email.your-domain.com) setting SSL to Flexible. Make sure to use a wildcard after your domain for the best results (e.g., https://email.your-domain.com/*).
• Turn this to On.

Step 3: Enable HTTPS In Mailgun (Create A Ticket Or Use The API)

Now that the above two steps are completed, HTTPS needs to be enabled within Mailgun.  There are two ways to accomplish this:

• Create a Support ticket via the Support page of the Mailgun control panel to let us know your page rule has been created. We will then set your links to default to HTTPS instead of HTTP. 
• Or, for users of the Mailgun APIs, the Domains API (see the docs here!) provides the web_scheme parameter, which can accept the values of HTTP or HTTPS.  For the domain in question, you will use an HTTP PUT request to set the web_scheme to HTTPS.

Got Questions?

Sinch Mailgun has answers! If you have any concerns or questions, please send us a Support ticket using the Support page within your Mailgun Control Panel.  Our Support Team will be happy to assist!