Add HSTS/CSP headers to responses on custom tracking domains
Our External Attack Surface Management (EASM) tooling continuously scans public hostnames resolving under our domain, including our custom tracking CNAME (pointing to t.mailjet.com). It flags these responses as missing standard security headers — specifically Strict-Transport-Security (HSTS) and Content-Security-Policy (CSP) — even though the domain is HTTPS-only.
We understand these endpoints mostly serve redirects and tracking pixels, so practical risk is limited. However:
HSTS is low-cost to add and prevents protocol-downgrade exposure on an HTTPS-only host.
CSP is relevant on any HTML pages served (e.g. broken-link, unsubscribe, or error pages) to reduce reflected-XSS risk.
Since these headers apply to the shared infrastructure behind all customer custom tracking domains, adding them centrally would improve security posture — and reduce false-positive EASM findings — for every customer using this feature, not just us.
Simon Carmelid
shared this idea