Summary
Chrome's escalating efforts to block mixed content have raised concerns among Salesforce Marketing Cloud users regarding email deliverability, particularly concerning unsecured click tracking domains. While the primary target of these browser-level blocks is web pages, not email content directly, there are nuanced impacts on how email clients display messages and user perception of security. Understanding the difference between how browsers and email clients handle mixed content is crucial for maintaining optimal deliverability and sender reputation.
Key findings
- Limited direct impact: Chrome's mixed content blocking primarily targets web pages, including images and landing pages, not email messages themselves. Email click tracking links are typically processed by the backend platform of webmail clients like Gmail or Outlook, not directly by the user's web browser.
- Email client warnings: Despite browser-level handling, webmail clients may independently flag or complain about mixed content within emails, especially if the sender is not in the recipient's address book. This can lead to visual warnings or broken elements, potentially affecting engagement.
- Image proxying: Major email providers like Gmail, Yahoo, and AOL proxy images through their own servers, often converting them to HTTPS regardless of the original source. This mitigates many mixed content issues related to images. Outlook also tends to handle mixed content gracefully.
- Industry shift: The broader internet is moving towards universal TLS (HTTPS) for all connections. While email may not be as immediately impacted as web pages, the trend suggests that full HTTPS compliance for all email assets, including links and images, is becoming a best practice to avoid future deliverability or display issues.
Key considerations
- Secure all assets: Although click tracking may not be directly affected, it is a best practice for ESPs and senders to ensure all endpoint links and images within emails are served over HTTPS. This includes custom tracking domains and content hosted on CDNs. Cisco provides resources on securing access, which generally aligns with secure content delivery. This approach is key to robust protection.
- Audit existing content: Regularly review Salesforce Marketing Cloud account settings, landing pages, and hand-coded email templates to identify and update any HTTP links or image sources to HTTPS.
- Leverage ESP features: Ensure your ESP (like Salesforce Marketing Cloud) is configured to use HTTPS for all its default tracking and content hosting. If using older features like classic landing pages, migrate to modern, secure alternatives like CloudPages.
- Monitor deliverability: While direct deliverability impact from browser mixed content blocking is low, consistent warnings or broken content can indirectly harm user engagement and sender reputation. Continuously monitor your email performance and address any signs of mixed content issues.
What email marketers say
Email marketers often find themselves navigating the complexities of technical changes that impact their campaigns. The concerns surrounding Chrome's mixed content blocking and its potential effects on Salesforce Marketing Cloud email deliverability highlight a common tension between browser security enhancements and traditional email practices. Many marketers question the direct impact on their email metrics, especially when dealing with click tracking and image loading, which historically have had different rules than web pages.
Key opinions
- Initial confusion: Marketers frequently express uncertainty about how browser-specific security updates, like Chrome's mixed content blocking, translate to email deliverability. There's often a need for clarification on whether these apply to elements like click tracking or just embedded images and linked web content.
- Focus on images and landing pages: The prevailing opinion among marketers is that Chrome's mixed content blocking is primarily geared towards images and landing pages, with less direct impact on email deliverability itself.
- Proxy mitigation: Many marketers acknowledge that major email clients (Gmail, Yahoo, AOL, Outlook) proxy images, effectively loading them over HTTPS, thereby reducing visible mixed content issues for recipients.
- Misleading warnings: Some marketers feel that platform-generated warnings (such as those from Salesforce Marketing Cloud) about mixed content can be overly alarmist or unclear, leading to unnecessary concern among clients about their email deliverability without precise context.
Key considerations
- Client education: It's important to clarify to clients and stakeholders that while browser security is tightening, email clients have different mechanisms for displaying content, such as image proxying. Marketers should explain where the actual risks lie and how they are mitigated.
- Proactive HTTPS adoption: Even if the immediate impact on email deliverability is minimal, marketers should proactively transition all assets, especially images and linked content, to HTTPS to align with modern web standards and prevent future issues. The Automation Champion blog often discusses Salesforce updates, which can inform these transitions.
- Review SFMC configurations: Regularly check Salesforce Marketing Cloud settings for portfolio bases, landing pages, and CloudPages to ensure they are configured to use HTTPS by default.
- Hand-coded content: Pay close attention to any hand-coded emails or landing pages to manually update HTTP image and link references to HTTPS, ensuring consistency and preventing mixed content warnings from rendering.
Marketer view
Marketer from Email Geeks expresses concern that Salesforce Marketing Cloud is issuing many warnings about Chrome blocking mixed content. They are specifically worried about unsecured click tracking domains hurting deliverability, even though their understanding is that it should only affect images and landing pages.
Marketer view
Marketer from Email Geeks states that the issue primarily concerns images loading over HTTP, not HTTPS, and clarifies that this does not impact links or click tracking in emails. They also note that major email providers like Gmail, Yahoo, AOL, and Outlook use proxies to load all images over HTTPS, preventing these issues from being seen.
What the experts say
Email deliverability experts often provide a more technical and nuanced perspective on how browser security changes, like Chrome's mixed content blocking, interact with email ecosystems. They emphasize the distinct rendering environments of web browsers versus email clients and highlight the industry's push towards universal encryption. Their insights are crucial for understanding the underlying mechanisms and best practices that ensure long-term email success, moving beyond immediate alarm to strategic adjustments.
Key opinions
- Backend processing of links: Experts confirm that click tracking links in emails are typically loaded by the email service's backend platform, not directly by the user's browser, thus isolating them from direct browser-level mixed content blocks.
- No excuse for HTTP: A strong consensus among experts is that there's no longer a valid reason for ESPs not to wrap all their endpoint links (including tracking links) in TLS. The ease of obtaining certificates (e.g., via Let's Encrypt) makes this a fundamental expectation.
- Client-side mixed content: While browsers aren't directly scanning email content, webmail clients (like Gmail and Outlook's web interfaces) can still flag mixed content warnings within messages, especially if the sender is not in the recipient's address book. This is distinct from browser mixed content blocking.
- Universal TLS trend: The email ecosystem, much like the web, is steadily moving towards requiring universal TLS for all content. While web pages are the current primary target, email is quickly catching up in this trend.
Key considerations
- Proactive security measures: Implement HTTPS for all email assets, including image URLs and click tracking links, even if the immediate deliverability impact is low. This is crucial for long-term sender reputation and to avoid future issues as standards evolve.
- Understand client behavior: Be aware that while major clients proxy images, other clients or specific configurations might still display warnings for mixed content. Prioritize securing all elements to ensure a consistent experience.
- ESP responsibility: Demand that your ESP provides secure (TLS/HTTPS) wrapping for all its services, including tracking domains. As noted by experts, modern email deliverability best practices necessitate this.
- Redirects vs. direct insecure links: If a tracking link initially uses HTTP but immediately redirects to an HTTPS page, it's generally less problematic. However, direct HTTP links to insecure content should be avoided.
Expert view
Expert from Email Geeks clarifies that when it comes to click tracking links, even if viewed in a browser like Chrome on webmail platforms such as Google or Outlook, the link itself is actually loaded by the backend platform, not the web browser directly. This distinction is crucial for understanding the scope of mixed content blocking.
Expert view
Expert from Email Geeks asserts that there is no justifiable reason for an Email Service Provider (ESP) not to secure all of their endpoint links with TLS (Transport Layer Security) in the current landscape of web security.
What the documentation says
Official documentation from platforms like Salesforce Marketing Cloud and browser developers like Chrome typically outlines policies and best practices for content security. These documents often serve as the primary source of truth, detailing the technical implications of insecure content and the steps users should take to comply with evolving security standards. Their focus is on ensuring a secure user experience across all digital touchpoints.
Key findings
- Chrome's mixed content policy: Chrome is actively deprecating insecure (HTTP) content on secure (HTTPS) pages, progressively blocking or warning about it. This applies to images, audio, video, and other embedded resources.
- Salesforce warnings: Salesforce Marketing Cloud itself issues warnings regarding Chrome's mixed content blocking, primarily indicating impacts on landing pages and images linked within campaigns. Their guidance typically advises migrating all content to HTTPS.
- Scope of impact: While the primary focus is web pages, documentation implies that any embedded or linked content (like images or external scripts) loaded within an email, particularly if it leads to a web page, should comply with HTTPS to avoid browser-level warnings or blockages when that content is accessed.
- HTTPS as a standard: Official documentation from browser vendors and email platforms increasingly positions HTTPS as the mandatory standard for all web and linked content, emphasizing security and user trust.
Key considerations
- Comprehensive HTTPS migration: Follow official guidance to convert all relevant content—including image URLs, custom domains for tracking and landing pages, and any other external resources—to HTTPS. This aligns with broader web security trends and mitigates potential deliverability issues as Google's security expectations tighten.
- Platform-specific instructions: Pay close attention to specific instructions from Salesforce Help documentation regarding securing assets within the platform, such as portfolio base URLs and content on CloudPages. The Salesforce warning about Chrome mixed content outlines these areas.
- User experience: Understand that mixed content warnings, even if not directly blocking email delivery, can degrade the user experience and lead to perceived insecurity. This indirectly affects engagement rates and can impact sender reputation.
- Code review: For hand-coded emails or landing pages, meticulously review the HTML code to ensure all image sources and link hrefs use HTTPS, eliminating potential mixed content issues at the source.
Technical article
Documentation from Salesforce Help outlines that Chrome is progressively enhancing its security measures, leading to warnings or blocking of mixed content (HTTP resources on HTTPS pages). This particularly impacts landing pages and images served via the platform.
Technical article
Salesforce documentation emphasizes the need for users to transition all content, including custom tracking domains and images, to HTTPS. It notes that insecure content can result in browser warnings, reduced trust, and potential display issues for recipients.
Related resources
5 resources
Related pages
Do email code analysis report errors impact deliverability?
Does google penalize for not using email encryption and how does it affect deliverability?
Why is google flagging my cdn or email content as malicious?
How to protect email deliverability for image-only emails?
Does using HTTPS/SSL for email links and images improve deliverability or performance?
Do HTTP tracking links affect email deliverability?
Is SSL important for tracked links and images in email marketing sender reputation and deliverability?
What is the deliverability impact of non-HTTPS engagement tracking in email marketing?
Why your emails fail: expert guide to improve email deliverability [2025]
A practical guide to understanding your email domain reputation
