• wraps email domains add and wraps email domains config accept --tracking-domain, so open and click links resolve through a host under your own domain instead of r.<region>.awstrack.me. --tracking-https requests an ACM certificate and puts a CloudFront distribution in front of that host — two runs, since ACM validation takes 5 to 30 minutes: the first prints the validation record, the second finishes once the certificate is ISSUED
• wraps email domains list and the dashboard report whether tracking links are HTTPS, per configuration set — a multi-domain account no longer reports one set’s state as the whole account’s. The failure hides well, since opens keep working over plain HTTP and only clicks break. Every tracking-domain write now carries an explicit HttpsPolicy instead of leaving it OPTIONAL, which wrapped click links in the original link’s protocol and produced a certificate warning instead of the destination — three paths could reach that OPTIONAL default, including domains verify re-issuing a policy-less write that downgraded an already-REQUIRE configuration set
• Fix: wraps email doctor --cleanup no longer treats an unreachable Pulumi stack probe or an unchecked CloudFormation stack as a proven orphan — a failed probe used to sweep in the console access role and the configuration sets domains add creates, and a CloudFormation quick-create deployment was mistaken for loose resources. A check that cannot confirm an orphan now refuses --cleanup instead of assuming, and names the owning stack when it finds one
• Fix: disabling and re-enabling HTTPS no longer hands back a CloudFront distribution the CLI had already switched off, breaking every click link until it is restored. A failed HTTPS provision during domains add now warns and falls back to plain HTTP instead of aborting and orphaning the identity it already created

CLI v3.6.0 · CLI v3.7.0