This article will tell you: 

• About Custom Tracking
• Options for setting up Custom Tracking
  • Reverse Proxy
  • Delegated DNS

Index

• Getting Started: Reverse proxy setup
• Getting Started: Delegated DNS setup
• Implementation Steps
• Troubleshooting

Overview

Custom Tracking enables advertisers to use their brand domain to capture partner channel performance in lieu of the Partnerize domain (prf.hn). Custom Tracking can be used in conjunction with your existing tracking method to: 

• Mitigate the risk of ad blockers inhibiting affiliate tracking by tying performance tracking to your brand instead of a tracking domain that could ultimately be identified and blocked.
• Complement future-proofed tracking infrastructure to support persistent tracking amidst evolving browser changes including Apple’s iOS 17 Link Tracking Protection.
• Ensures accurate data regardless of ad blockers and Link Tracking Protection to support data-driven decisioning, accurate attribution and equitable partner rewards.

To begin Custom Tracking implementation, you must: 

1. Choose your approach. Select a Custom Tracking implementation method that is best for your business between Reverse Proxy and Delegated DNS
2. Share Custom Tracking documentation with your tech team. Share the relevant step-by-step guide for implementing Custom Tracking with your tech team.
3. Confirm with your account team or Support when the update is complete. Once completed, Partnerize must ensure that the update is tracking appropriately. Connect with your account team or Support to perform a test.
4. Notify your partners of required action. While a temporary redirect for partner links is in place following the update, it is not a long term solution. Partners must swap out existing links for your brand to align with your domain. 

Getting Started: Custom Tracking Reverse proxy

Reverse proxy is the most robust Custom Tracking solution, considered “the gold standard”. By routing traffic through a reverse proxy on your server, tracking becomes indistinguishable from your site’s core functional traffic.

To implement Reverse Proxy, you must first set up a reverse proxy (a server that will forward performance activity to your brand’s web server) as well as a tracking domain or sub domain owned by your brand (i.e. https://example.molimo.com). The reverse proxy will:

• For all advertisers: Send clicks captured via Custom Tracking to Partnerize in real time.
• For advertisers using pixel-based solutions: Send conversions to the brand’s tracking domain.
• For existing advertisers using server-to-server tracking with a prf.hn: No action required to begin using Custom Tracking. However, new-to-Partnerize advertisers implementing server-to-server tracking should follow these steps to implement Custom Tracking.

NOTE: Your proxy must terminate TLS with your own certificate and open a new upstream connection to Partnerize. It is a Layer 7 reverse proxy, not a pass-through. If your load balancer instead does TCP/SSL passthrough, it forwards the browser's original TLS — including the browser's SNI, which is your domain — straight to Partnerize. Partnerize holds no certificate for your domain, so the upstream handshake fails and tracking breaks.

Implementation Steps

Step 1: Advertiser to Choose Custom Tracking URL

Choose a Custom Tracking URL to be used. You can use either a subdomain (i.e. “https://example.molimo.com”) or a path (i.e. “https://molimo.com/example”).

Note that the subdomain or path should not make any reference to tracking, as we want to ensure browsers and other technologies i.e. adblockers cannot easily identify that the URL is being used for tracking purposes.

Step 2: Partnerize to Configure Custom Tracking URL

Partnerize team will configure your chosen Custom tracking URL within the Partnerize platform, and share instructions to set up the reverse proxy.

Step 3: Advertiser to set up DNS (subdomain only)

For a new subdomain, you need to use your existing DNS provider to make it available and point at your existing loadbalancer, i.e.

example.molimo.com. 1800 IN CNAME molimo.com

❗NOTE: A loadbalancer is a device or software that distributes network traffic across multiple servers, preventing any single server from being overloaded and improving application performance, availability, and fault tolerance

Step 4: Advertiser to update Loadbalancer 

On your existing loadbalancer, there are a few required config changes:

1. All traffic to the subdomain or path must be proxied through to “https://track.partnerize.com” Your proxy must terminate TLS with your own certificate and open a new upstream connection —  do not use TCP/SSL passthrough
2. (Path only) rewrite the request path so that the path prefix (i.e. “/example”) is not sent
3. Ensure that the upstream SSL certificate is verified and that the upstream SNI is set to track.partnerize.com (see the "Host header vs SNI" note below)
4. Ensure "Host" header is maintained and passed to Partnerize
5. Append the request IP to the “X-Forwarded-For” request header
6. Set the “Authorization” request header to “Bearer [token]” where [token] is supplied by step 1

Depending on your loadbalancer, you might need to stop it from amending the request further i.e. not to encode any characters, merge slashes, or block large headers. This can otherwise have a negative impact on your tracking.

⚠️ Host header and TLS SNI are different things — do not make them match. Host header  -> your own domain. Partnerize routes on it, so it needs to be kept.Upstream SNI -> must always be track.partnerize.com.

Step 5: Partnerize to Verify Tracking

On the Partnerize platform, verify the Custom Tracking URL created in step 1. If everything is set up correctly, you should be able to continue to the next step. If not, you will receive an error message after testing the installation with steps for resolution.

Step 6: Advertiser and Partnerize to Perform Testing 

Once the Custom Tracking URL has been verified, two test cases need to be completed on a test campaign on the your live network:

1. Click testing:
   1. Click test link using the custom domain to check that the redirect to your website works as expected
   2. Check that any query string parameters (appends) are retained
   3. Check that the Partnerize clickref is being stored in a cookie
2. Conversion testing:
   1. Click test link using the custom domain
   2. Place an order on the live site and provide Partnerize with the Order ID

If both test cases are successful, we are ready for live campaign enablement.

Step 7: Partnerize to Enable Custom Tracking on your Campaign

Custom tracking can now be enabled for your live campaigns.  The reverse proxy tracking should take effect immediately after this final step for and all links and creatives that partners will retrieve via the Partnerize platform.

Step 8: Partner Link Updates (Exclusive to Existing Partnerize Advertisers)

Partners that are actively promoting your brand must make updates to their affiliate tracking links to ensure accurate, persistent tracking against ad blockers following Custom Tracking implementation. Once you’ve completed the update, please share our step-by-step guide for updating links with your partners. While partner tracking links that use the prf.hn will temporarily redirect to your new domain, this is not a long term solution, and partners must update their links at their earliest convenience to ensure safeguards against ad blockers and privacy changes. 

If you have additional questions about migrating to Custom Tracking, please contact Support.

❗️NOTE: You can find out more about what a reverse proxy is here

Troubleshooting

Example configurations

(note these are illustrative and may vary depending on your exact set up)

NGINX: 

NGINX does NOT send an SNI to the upstream by default (proxy_ssl_server_name defaults to off). You must enable it and pin the name to track.partnerize.com, otherwise the upstream connection is negotiated without SNI and relies on Partnerize serving a default certificate.

APACHE: 

Apache's mod_proxy already sends the SNI derived from the ProxyPass target (track.partnerize.com),so there is NOTHING to add for SNI. The change here is to re-enable peer-name verification — the previous example disabled it with SSLProxyCheckPeerName off, which hides a misconfiguration and weakens security.

# Load required modules
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule ssl_module modules/mod_ssl.so

# HTTPS (https://ssl-config.mozilla.org/#server=apache&version=2.4.60&config=intermediate&openssl=3.4.0&hsts=false&ocsp=false&guideline=5.7)
# TODO: change "/path/to/cert.pem" to your public certificate
# TODO: change "/path/to/key.pem" to your private key

    SSLEngine on
    SSLCertificateFile /path/to/cert.pem
    SSLCertificateKeyFile /path/to/key.pem
    SSLProtocol -all +TLSv1.2 +TLSv1.3
    SSLOpenSSLConfCmd Curves X25519:prime256v1:secp384r1
    SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
    SSLHonorCipherOrder off
    SSLSessionTickets off


# Upstream HTTPS
# TODO: change "/path/to/certs.crt" to your certificate store
SSLProxyEngine on
SSLProxyVerify require
SSLProxyVerifyDepth 10
SSLProxyCheckPeerName off
SSLProxyCACertificateFile "/path/to/certs.crt"

# Allow encoded `/` in path
AllowEncodedSlashes NoDecode

# Do not merge slashes
MergeSlashes Off

# Keep Host and set Authorization header
# TODO: change "123456" to your auth token
ProxyPreserveHost On
RequestHeader set Authorization "Bearer 123456"

# Proxy
# TODO: when using a path, change "/" to your path
ProxyPass "/" https://track.partnerize.com/ nocanon
ProxyPassReverse "/" https://track.partnerize.com/


 

Common issue: wrong SNI / certificate verification fails

Symptom: upstream TLS errors, or Partnerize cannot verify the tracking URL.

Cause:   the proxy is presenting the wrong SNI (your domain instead of track.partnerize.com), or a load balancer is doing TCP/TLS passthrough instead of terminating TLS.

Fix:

NGINX  -> add:  proxy_ssl_server_name on; proxy_ssl_name track.partnerize.com; Apache -> mod_proxy already sends the right SNI; set SSLProxyCheckPeerName on and ensure ProxyPass targets https://track.partnerize.com/. Any LB -> terminate TLS at the proxy; do not pass through.

Getting Started: Custom Tracking Delegated DNS Setup

Delegated DNS is an accessible, lower-lift alternative to Custom Tracking implementation. By delegating a subdomain of your brand using NS records to Partnerize. It is significantly easier to implement while still providing the core benefits of first-party tracking.

Step 1: Advertiser to Choose Custom Tracking URL

Choose a Custom Tracking URL to be used. This is likely to be a subdomain.

Note that the subdomain should not make any reference to tracking, as we want to ensure browsers and other technologies i.e. adblockers cannot easily identify that the URL is being used for tracking purposes.

Step 2: Configure the tracking URL

Once a custom tracking URL has been chosen, navigate to the Tracking Configurations within the platform and select Custom Tracking. Once the new custom tracking URL is added, choose the delegated DNS option and save. 

Step 3: Registering and delegating the domain

Once the custom tracking URL is saved, instructions must be followed to register the domain and then delegate the domain to Partnerize’s DNS. Once that has been done, hit the verify button. Please note before step 4 is available there may be a small delay as Partnerize processes the request. 

Step 4: Partnerize to Enable Custom Tracking on your Campaign

Custom Tracking can now be enabled for your live campaigns. The Delegated DNS method should take effect immediately after this final step for the campaigns selected and all links and creatives that partners will retrieve via the Partnerize platform should be updated accordingly.