# Custom Tracking Domains & Proven-Orphan Cleanup | Changelog

Source: https://wraps.dev/changelog/custom-tracking-domains-and-proven-orphan-cleanup

![Wraps Logo](https://wraps.dev/wraps-light-logo.png)![Wraps Logo](https://wraps.dev/wraps-dark-logo.png)

](https://wraps.dev/)

[](https://github.com/wraps-team/wraps)[Log in](https://app.wraps.dev/auth?mode=signin)[Sign up](https://app.wraps.dev/auth?mode=signup)

Toggle menu

[← All changes](https://wraps.dev/changelog)

CLISeptember 2026

### Custom Tracking Domains & Proven-Orphan Cleanup

Custom tracking domains resolve over HTTPS by default, and doctor --cleanup no longer guesses at orphaned resources.

![A Wraps card reading: CLI v3.6.0 — Custom tracking domains. Open and click links resolve through a host you own.](https://wraps.dev/_next/image?url=%2Femail%2F2026-09-tracking-domains.png&w=3840&q=75&dpl=dpl_VehRCjcz7WHYU3nef8UNqcfyh7aq)

-   `wraps email domains add` and `wraps email domains config` accept `--tracking-domain`, so open and click links resolve through a host under your own domain instead of `r.<region>.awstrack.me`. `--tracking-https` requests an ACM certificate and puts a CloudFront distribution in front of that host — two runs, since ACM validation takes 5 to 30 minutes: the first prints the validation record, the second finishes once the certificate is ISSUED
-   `wraps email domains list` and the dashboard report whether tracking links are HTTPS, per configuration set — a multi-domain account no longer reports one set’s state as the whole account’s. The failure hides well, since opens keep working over plain HTTP and only clicks break. Every tracking-domain write now carries an explicit `HttpsPolicy` instead of leaving it `OPTIONAL`, which wrapped click links in the original link’s protocol and produced a certificate warning instead of the destination — three paths could reach that `OPTIONAL` default, including `domains verify` re-issuing a policy-less write that downgraded an already-`REQUIRE` configuration set
-   Fix: `wraps email doctor --cleanup` no longer treats an unreachable Pulumi stack probe or an unchecked CloudFormation stack as a proven orphan — a failed probe used to sweep in the console access role and the configuration sets `domains add` creates, and a CloudFormation quick-create deployment was mistaken for loose resources. A check that cannot confirm an orphan now refuses `--cleanup` instead of assuming, and names the owning stack when it finds one
-   Fix: disabling and re-enabling HTTPS no longer hands back a CloudFront distribution the CLI had already switched off, breaking every click link until it is restored. A failed HTTPS provision during `domains add` now warns and falls back to plain HTTP instead of aborting and orphaning the identity it already created

Also fixed (8)

-   The five tracking-domain error codes are documented at /docs/reference/errors; a subdomain that was never added separately inherits the primary domain's tracking host.
-   If you saw "Cannot find module '@wraps/core'" in index.d.ts when installing @wraps.dev/cdk or @wraps.dev/pulumi, upgrade to CDK v0.3.1 or Pulumi v0.4.1 — the published type declarations no longer reference the unpublished @wraps/core package.
-   domains config --tracking-domain now offers HTTPS at the point it sets the domain, instead of requiring a second trip through the menu.
-   A zone-scoped Cloudflare token (Zone → DNS → Edit) now validates correctly for DNS automation; validation previously required the broader User → API Tokens → Read scope it didn't need.
-   Two DNS paths that used to fail silently now report whether the record was written: the tracking CNAME print, and the ACM validation push that gates certificate issuance.
-   ACM and CloudFront listings are paginated too, so a second page no longer causes a fresh certificate request on every run.
-   wraps --help was hiding thirteen shipped subcommands across five groups, including email reply, email logs and workflow entirely; a parity test now checks the dispatcher against the help output.
-   @wraps.dev/pulumi and @wraps.dev/cdk both accepted tracking.customRedirectDomain and failed differently — Pulumi deployed it with SES's OPTIONAL policy and no CloudFront, CDK ignored it entirely; both now warn at deploy time.

CLI v3.6.0 · CLI v3.7.0

[Read the docs →](https://wraps.dev/docs/guides/domain-verification)