Why agencies should turn off click tracking on first-touch cold email

Most cold email tools ship with click tracking on, and most agencies leave it that way because clients like seeing a click column in the report. We think that is backwards for the first touch. Click tracking on a cold first email costs you deliverability you cannot see, produces numbers you cannot trust, and puts something in front of the prospect that looks a lot like what phishing filters are trained to catch.

Turn it off for step one. If you need a link at all, send it plain, and send it after someone asks.

What click tracking actually does to the message

When click tracking is on, your tool does not send the link you wrote. It swaps it for a redirect on a tracking domain, logs the visit, then forwards the reader to the real page. lemlist's own coaching article on this describes it exactly that way, and it lists the problems that follow. Redirect links are a classic phishing pattern. Default tracking domains are shared with every other customer of the tool, so your client's message carries the reputation of senders you will never meet. Corporate security tools often flag or quarantine mail with redirect links.

Resend made the same point when it launched custom tracking domains: tracking usually relies on shared domains, so "reputation is shared as well," and if others on that domain send badly, your deliverability can suffer.

Google's sender guidelines do not ban tracked links, but they do say web links in the message body should be visible and easy to understand, and recipients should know what to expect when they click. A first-touch cold email whose only link resolves to an unfamiliar redirect host does not meet that standard in spirit, even if the anchor text looks fine.

For an agency, the cost lands on the client. The domain that takes the hit is theirs.

The click numbers are not real enough to report

Even if deliverability were not a concern, the data would not hold up. Microsoft's documentation for Safe Links in Defender for Office 365 says inbound links are scanned before delivery, rewritten to a Safe Links URL, checked again at the moment of click, and links without a valid reputation can be detonated in the background. Other security gateways do similar things. lemlist's article puts the practical result plainly: security bots click links before the recipient sees the email, and you cannot tell those clicks apart from human interest.

So a client report that shows a healthy click rate on step one may be measuring the prospect's security stack. We already argued that open rate belongs out of client reports. First-touch click rate belongs in the same bin, for a similar reason: the machine in the middle is generating the event.

"Just use a custom tracking domain" is a half fix

The standard answer is to set up a custom tracking domain so links resolve to a subdomain the client owns. That is better than a shared domain. Klaviyo's help docs note that aligning the click-tracking domain with the sending domain supports deliverability, and lemlist now blocks sending with tracking enabled unless a custom tracking domain is configured.

But lemlist's own ranking is telling. Best: no links in a cold email. Good: one plain, untracked link. Acceptable: tracked links on a custom tracking domain. Poor: tracked links on the default domain. Even the vendor that sells tracking puts untracked first.

A custom tracking domain also adds another DNS record per client workspace that someone has to set up, verify, keep on HTTPS, and remember during offboarding. If the data it produces on step one is mostly scanner traffic, that is maintenance for very little.

What to do instead

Write step one without links. The first message has one job: get a reply. A link competes with that. lemlist's coaching and AutoMail's signature guide both recommend asking permission before sending a resource: describe the thing, ask if they want it, and send it in the reply thread.

If a link must go in, make it one, plain, and on the client's own domain. No URL shortener, no redirect, no UTM string in a cold first touch. The domain in the link should match the domain in the From line.

Move tracking to where it is useful. Once a prospect replies and asks for something, a link with UTM parameters inside the thread is fine. The visit then shows up in the client's site analytics, attached to a real conversation.

Report outcomes the scanners cannot fake. Replies by class, positive replies, booked conversations, and meetings held. Bounces and spam complaints for health. A click column on step one adds noise to that report.

The objections we hear

"The client wants to know what's working." Then test subject lines and angles on reply rate. A variant that gets fewer clicks and more replies is the winner, and the client will understand that faster than a chart they cannot audit.

"We need clicks to trigger follow-up logic." A bot click that triggers a "saw you checked out our page" follow-up is worse than no trigger. It tells a prospect you are watching them, and it is wrong.

"Later steps need a booking link." Fine. Later steps, after intent shows up, with tracking decisions made per step and per client. The argument here is about the first touch, where the risk is highest and the data is weakest.

Where GTM fits

GTM runs find, qualify, write, send, reply, and book in isolated client workspaces, with send windows, limits, and a compliance gate that refuses any send missing a verdict and an unsubscribe URL. The measure we care about is booked conversations per client, not clicks. Writing a first touch that earns a reply without asking a stranger to click anything is part of that.

If you run outbound for several clients and want reporting built on replies and booked calls, join the waitlist.

Sources

• lemlist Help Center, "lemcoach: Should you track clicks and opens in cold email campaigns?": https://help.lemlist.com/en/articles/13941647-lemcoach-should-you-track-clicks-and-opens-in-cold-email-campaigns
• lemlist Help Center, "Disable email tracking": https://help.lemlist.com/en/articles/4494093-disable-email-tracking
• Microsoft Learn, "Safe Links in Microsoft Defender for Office 365": https://learn.microsoft.com/en-us/defender-office-365/safe-links-about
• Google Workspace Admin Help, "Email sender guidelines": https://support.google.com/a/answer/81126
• Resend, "Introducing custom tracking domains": https://resend.com/blog/introducing-custom-tracking-domain
• Klaviyo Help Center, "How to set up dedicated click tracking": https://help.klaviyo.com/hc/en-us/articles/360001550572
• AutoMail, "Cold email signature examples and CAN-SPAM rules": https://automail.ai/blog/cold-email-signature