diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.js.snapshot/ConfigurationSetIntegDefaultTestDeployAssert9B6AD46A.assets.json b/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.js.snapshot/ConfigurationSetIntegDefaultTestDeployAssert9B6AD46A.assets.json
new file mode 100644
index 0000000000000..74e082f2f9eb7
--- /dev/null
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.js.snapshot/ConfigurationSetIntegDefaultTestDeployAssert9B6AD46A.assets.json
@@ -0,0 +1,20 @@
+{
+  "version": "41.0.0",
+  "files": {
+    "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
+      "displayName": "ConfigurationSetIntegDefaultTestDeployAssert9B6AD46A Template",
+      "source": {
+        "path": "ConfigurationSetIntegDefaultTestDeployAssert9B6AD46A.template.json",
+        "packaging": "file"
+      },
+      "destinations": {
+        "current_account-current_region": {
+          "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
+          "objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
+          "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
+        }
+      }
+    }
+  },
+  "dockerImages": {}
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.js.snapshot/ConfigurationSetIntegDefaultTestDeployAssert9B6AD46A.template.json b/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.js.snapshot/ConfigurationSetIntegDefaultTestDeployAssert9B6AD46A.template.json
new file mode 100644
index 0000000000000..ad9d0fb73d1dd
--- /dev/null
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.js.snapshot/ConfigurationSetIntegDefaultTestDeployAssert9B6AD46A.template.json
@@ -0,0 +1,36 @@
+{
+ "Parameters": {
+  "BootstrapVersion": {
+   "Type": "AWS::SSM::Parameter::Value<String>",
+   "Default": "/cdk-bootstrap/hnb659fds/version",
+   "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
+  }
+ },
+ "Rules": {
+  "CheckBootstrapVersion": {
+   "Assertions": [
+    {
+     "Assert": {
+      "Fn::Not": [
+       {
+        "Fn::Contains": [
+         [
+          "1",
+          "2",
+          "3",
+          "4",
+          "5"
+         ],
+         {
+          "Ref": "BootstrapVersion"
+         }
+        ]
+       }
+      ]
+     },
+     "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
+    }
+   ]
+  }
+ }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.js.snapshot/cdk.out b/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.js.snapshot/cdk.out
new file mode 100644
index 0000000000000..188478b55560e
--- /dev/null
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.js.snapshot/cdk.out
@@ -0,0 +1 @@
+{"version":"41.0.0"}
\ No newline at end of file
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.js.snapshot/integ.json b/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.js.snapshot/integ.json
new file mode 100644
index 0000000000000..c6a01b99bd5e4
--- /dev/null
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.js.snapshot/integ.json
@@ -0,0 +1,14 @@
+{
+  "version": "41.0.0",
+  "testCases": {
+    "ConfigurationSetInteg/DefaultTest": {
+      "stacks": [
+        "ses-configuration-set-tracking-options-integ"
+      ],
+      "stackUpdateWorkflow": false,
+      "assertionStack": "ConfigurationSetInteg/DefaultTest/DeployAssert",
+      "assertionStackName": "ConfigurationSetIntegDefaultTestDeployAssert9B6AD46A"
+    }
+  },
+  "minimumCliVersion": "2.1005.0"
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.js.snapshot/manifest.json b/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.js.snapshot/manifest.json
new file mode 100644
index 0000000000000..89b26746b35dc
--- /dev/null
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.js.snapshot/manifest.json
@@ -0,0 +1,120 @@
+{
+  "version": "43.0.0",
+  "artifacts": {
+    "ses-configuration-set-tracking-options-integ.assets": {
+      "type": "cdk:asset-manifest",
+      "properties": {
+        "file": "ses-configuration-set-tracking-options-integ.assets.json",
+        "requiresBootstrapStackVersion": 6,
+        "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
+      }
+    },
+    "ses-configuration-set-tracking-options-integ": {
+      "type": "aws:cloudformation:stack",
+      "environment": "aws://unknown-account/unknown-region",
+      "properties": {
+        "templateFile": "ses-configuration-set-tracking-options-integ.template.json",
+        "terminationProtection": false,
+        "validateOnSynth": false,
+        "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
+        "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
+        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/86057bab9ee2a7522fb13da9bb9e4b35e39ee1e7f76d1abaf54dedaf1bffa4e8.json",
+        "requiresBootstrapStackVersion": 6,
+        "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
+        "additionalDependencies": [
+          "ses-configuration-set-tracking-options-integ.assets"
+        ],
+        "lookupRole": {
+          "arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}",
+          "requiresBootstrapStackVersion": 8,
+          "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
+        }
+      },
+      "dependencies": [
+        "ses-configuration-set-tracking-options-integ.assets"
+      ],
+      "metadata": {
+        "/ses-configuration-set-tracking-options-integ/ConfigurationSet": [
+          {
+            "type": "aws:cdk:analytics:construct",
+            "data": "*"
+          }
+        ],
+        "/ses-configuration-set-tracking-options-integ/ConfigurationSet/Resource": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "ConfigurationSet3DD38186"
+          }
+        ],
+        "/ses-configuration-set-tracking-options-integ/BootstrapVersion": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "BootstrapVersion"
+          }
+        ],
+        "/ses-configuration-set-tracking-options-integ/CheckBootstrapVersion": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "CheckBootstrapVersion"
+          }
+        ]
+      },
+      "displayName": "ses-configuration-set-tracking-options-integ"
+    },
+    "ConfigurationSetIntegDefaultTestDeployAssert9B6AD46A.assets": {
+      "type": "cdk:asset-manifest",
+      "properties": {
+        "file": "ConfigurationSetIntegDefaultTestDeployAssert9B6AD46A.assets.json",
+        "requiresBootstrapStackVersion": 6,
+        "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
+      }
+    },
+    "ConfigurationSetIntegDefaultTestDeployAssert9B6AD46A": {
+      "type": "aws:cloudformation:stack",
+      "environment": "aws://unknown-account/unknown-region",
+      "properties": {
+        "templateFile": "ConfigurationSetIntegDefaultTestDeployAssert9B6AD46A.template.json",
+        "terminationProtection": false,
+        "validateOnSynth": false,
+        "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
+        "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
+        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
+        "requiresBootstrapStackVersion": 6,
+        "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
+        "additionalDependencies": [
+          "ConfigurationSetIntegDefaultTestDeployAssert9B6AD46A.assets"
+        ],
+        "lookupRole": {
+          "arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}",
+          "requiresBootstrapStackVersion": 8,
+          "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
+        }
+      },
+      "dependencies": [
+        "ConfigurationSetIntegDefaultTestDeployAssert9B6AD46A.assets"
+      ],
+      "metadata": {
+        "/ConfigurationSetInteg/DefaultTest/DeployAssert/BootstrapVersion": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "BootstrapVersion"
+          }
+        ],
+        "/ConfigurationSetInteg/DefaultTest/DeployAssert/CheckBootstrapVersion": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "CheckBootstrapVersion"
+          }
+        ]
+      },
+      "displayName": "ConfigurationSetInteg/DefaultTest/DeployAssert"
+    },
+    "Tree": {
+      "type": "cdk:tree",
+      "properties": {
+        "file": "tree.json"
+      }
+    }
+  },
+  "minimumCliVersion": "2.1014.0"
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.js.snapshot/ses-configuration-set-tracking-options-integ.assets.json b/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.js.snapshot/ses-configuration-set-tracking-options-integ.assets.json
new file mode 100644
index 0000000000000..84599471345f2
--- /dev/null
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.js.snapshot/ses-configuration-set-tracking-options-integ.assets.json
@@ -0,0 +1,20 @@
+{
+  "version": "41.0.0",
+  "files": {
+    "86057bab9ee2a7522fb13da9bb9e4b35e39ee1e7f76d1abaf54dedaf1bffa4e8": {
+      "displayName": "ses-configuration-set-tracking-options-integ Template",
+      "source": {
+        "path": "ses-configuration-set-tracking-options-integ.template.json",
+        "packaging": "file"
+      },
+      "destinations": {
+        "current_account-current_region": {
+          "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
+          "objectKey": "86057bab9ee2a7522fb13da9bb9e4b35e39ee1e7f76d1abaf54dedaf1bffa4e8.json",
+          "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
+        }
+      }
+    }
+  },
+  "dockerImages": {}
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.js.snapshot/ses-configuration-set-tracking-options-integ.template.json b/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.js.snapshot/ses-configuration-set-tracking-options-integ.template.json
new file mode 100644
index 0000000000000..6966aff1f866d
--- /dev/null
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.js.snapshot/ses-configuration-set-tracking-options-integ.template.json
@@ -0,0 +1,47 @@
+{
+ "Resources": {
+  "ConfigurationSet3DD38186": {
+   "Type": "AWS::SES::ConfigurationSet",
+   "Properties": {
+    "TrackingOptions": {
+     "CustomRedirectDomain": "tracking.example.com",
+     "HttpsPolicy": "REQUIRE"
+    }
+   }
+  }
+ },
+ "Parameters": {
+  "BootstrapVersion": {
+   "Type": "AWS::SSM::Parameter::Value<String>",
+   "Default": "/cdk-bootstrap/hnb659fds/version",
+   "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
+  }
+ },
+ "Rules": {
+  "CheckBootstrapVersion": {
+   "Assertions": [
+    {
+     "Assert": {
+      "Fn::Not": [
+       {
+        "Fn::Contains": [
+         [
+          "1",
+          "2",
+          "3",
+          "4",
+          "5"
+         ],
+         {
+          "Ref": "BootstrapVersion"
+         }
+        ]
+       }
+      ]
+     },
+     "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
+    }
+   ]
+  }
+ }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.js.snapshot/tree.json b/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.js.snapshot/tree.json
new file mode 100644
index 0000000000000..7dac98afd45f4
--- /dev/null
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.js.snapshot/tree.json
@@ -0,0 +1 @@
+{"version":"tree-0.1","tree":{"id":"App","path":"","children":{"ses-configuration-set-tracking-options-integ":{"id":"ses-configuration-set-tracking-options-integ","path":"ses-configuration-set-tracking-options-integ","children":{"ConfigurationSet":{"id":"ConfigurationSet","path":"ses-configuration-set-tracking-options-integ/ConfigurationSet","children":{"Resource":{"id":"Resource","path":"ses-configuration-set-tracking-options-integ/ConfigurationSet/Resource","attributes":{"aws:cdk:cloudformation:type":"AWS::SES::ConfigurationSet","aws:cdk:cloudformation:props":{"trackingOptions":{"customRedirectDomain":"tracking.naonao.org","httpsPolicy":"REQUIRE"}}},"constructInfo":{"fqn":"constructs.Construct","version":"10.4.2"}}},"constructInfo":{"fqn":"constructs.Construct","version":"10.4.2","metadata":["*"]}},"BootstrapVersion":{"id":"BootstrapVersion","path":"ses-configuration-set-tracking-options-integ/BootstrapVersion","constructInfo":{"fqn":"constructs.Construct","version":"10.4.2"}},"CheckBootstrapVersion":{"id":"CheckBootstrapVersion","path":"ses-configuration-set-tracking-options-integ/CheckBootstrapVersion","constructInfo":{"fqn":"constructs.Construct","version":"10.4.2"}}},"constructInfo":{"fqn":"constructs.Construct","version":"10.4.2"}},"ConfigurationSetInteg":{"id":"ConfigurationSetInteg","path":"ConfigurationSetInteg","children":{"DefaultTest":{"id":"DefaultTest","path":"ConfigurationSetInteg/DefaultTest","children":{"Default":{"id":"Default","path":"ConfigurationSetInteg/DefaultTest/Default","constructInfo":{"fqn":"constructs.Construct","version":"10.4.2"}},"DeployAssert":{"id":"DeployAssert","path":"ConfigurationSetInteg/DefaultTest/DeployAssert","children":{"BootstrapVersion":{"id":"BootstrapVersion","path":"ConfigurationSetInteg/DefaultTest/DeployAssert/BootstrapVersion","constructInfo":{"fqn":"constructs.Construct","version":"10.4.2"}},"CheckBootstrapVersion":{"id":"CheckBootstrapVersion","path":"ConfigurationSetInteg/DefaultTest/DeployAssert/CheckBootstrapVersion","constructInfo":{"fqn":"constructs.Construct","version":"10.4.2"}}},"constructInfo":{"fqn":"constructs.Construct","version":"10.4.2"}}},"constructInfo":{"fqn":"@aws-cdk/integ-tests-alpha.IntegTestCase","version":"0.0.0"}}},"constructInfo":{"fqn":"@aws-cdk/integ-tests-alpha.IntegTest","version":"0.0.0"}},"Tree":{"id":"Tree","path":"Tree","constructInfo":{"fqn":"constructs.Construct","version":"10.4.2"}}},"constructInfo":{"fqn":"constructs.Construct","version":"10.4.2"}}}
\ No newline at end of file
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.ts
new file mode 100644
index 0000000000000..03002b76f29fe
--- /dev/null
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.ts
@@ -0,0 +1,41 @@
+import { App, Stack, StackProps } from 'aws-cdk-lib';
+import * as integ from '@aws-cdk/integ-tests-alpha';
+import { Construct } from 'constructs';
+import * as ses from 'aws-cdk-lib/aws-ses';
+
+/**
+ * In order to test this you need to have a valid public hosted zone that you can use
+ * to validate the domain identity.
+ *
+ * Step 1: Create a public hosted zone in Route53
+ * Step 2: Create a email identity in SES and validate it with the hosted zone
+ * Step 3: Set the hosted zone name as an env var "HOSTED_ZONE_NAME"
+ * Step 4: Run this test
+ * Step 5: Correct the hosted zone name in the generated template to `tracking.example.com `
+ */
+const hostedZoneName = process.env.CDK_INTEG_HOSTED_ZONE_NAME ?? process.env.HOSTED_ZONE_NAME;
+if (!hostedZoneName) throw new Error('For this test you must provide your own HostedZoneName as an env var "HOSTED_ZONE_NAME". See framework-integ/README.md for details.');
+
+interface TestStackProps extends StackProps {
+  hostedZoneName: string;
+}
+
+class ConfigurationSetStack extends Stack {
+  constructor(scope: Construct, id: string, props: TestStackProps) {
+    super(scope, id, props);
+
+    new ses.ConfigurationSet(this, 'ConfigurationSet', {
+      customTrackingRedirectDomain: `tracking.${props.hostedZoneName}`,
+      customTrackingHttpsPolicy: ses.HttpsPolicy.REQUIRE,
+    });
+  }
+}
+
+const app = new App();
+
+new integ.IntegTest(app, 'ConfigurationSetInteg', {
+  testCases: [new ConfigurationSetStack(app, 'ses-configuration-set-tracking-options-integ', {
+    hostedZoneName,
+  })],
+  stackUpdateWorkflow: false,
+});
diff --git a/packages/aws-cdk-lib/aws-ses/README.md b/packages/aws-cdk-lib/aws-ses/README.md
index 4dfd21d813335..0980bdb8a6b0c 100644
--- a/packages/aws-cdk-lib/aws-ses/README.md
+++ b/packages/aws-cdk-lib/aws-ses/README.md
@@ -139,7 +139,6 @@ import { Duration } from 'aws-cdk-lib';
 declare const myPool: ses.IDedicatedIpPool;
 
 new ses.ConfigurationSet(this, 'ConfigurationSet', {
-  customTrackingRedirectDomain: 'track.cdk.dev',
   tlsPolicy: ses.ConfigurationSetTlsPolicy.REQUIRE,
   dedicatedIpPool: myPool,
   // Specify maximum delivery time
@@ -200,6 +199,20 @@ myConfigurationSet.addEventDestination('ToFirehose', {
 })
 ```
 
+#### Tracking options
+
+You can specify to use a custom redirect domain to handle open and click tracking for email sent with this configuration set by using `customTrackingRedirectDomain` and `customTrackingHttpsPolicy`.
+Detail can be found in [Custom tracking domain](https://docs.aws.amazon.com/ses/latest/dg/configure-custom-open-click-domains.html).
+
+```ts
+new ses.ConfigurationSet(this, 'ConfigurationSet', {
+  customTrackingRedirectDomain: 'track.cdk.dev',
+  customTrackingHttpsPolicy: ses.HttpsPolicy.REQUIRE,
+});
+```
+
+**Note**: The custom tracking redirect domain must be verified in Amazon SES. To create verified identities, you can use the [`EmailIdentity` construct](#email-identity).
+
 ### Override account-level suppression list settings
 
 You can customize account-level suppression list separately for different configuration sets by overriding it
diff --git a/packages/aws-cdk-lib/aws-ses/lib/configuration-set.ts b/packages/aws-cdk-lib/aws-ses/lib/configuration-set.ts
index cecddee1fec5a..21176a5e75ece 100644
--- a/packages/aws-cdk-lib/aws-ses/lib/configuration-set.ts
+++ b/packages/aws-cdk-lib/aws-ses/lib/configuration-set.ts
@@ -84,6 +84,13 @@ export interface ConfigurationSetProps {
    */
   readonly customTrackingRedirectDomain?: string;
 
+  /**
+   * The https policy to use for tracking open and click events.
+   *
+   * @default - HttpsPolicy.OPTIONAL if customTrackingRedirectDomain is set, otherwise undefined
+   */
+  readonly customTrackingHttpsPolicy?: HttpsPolicy;
+
   /**
    * The Virtual Deliverability Manager (VDM) options that apply to the configuration set
    *
@@ -135,6 +142,28 @@ export enum ConfigurationSetTlsPolicy {
   OPTIONAL = 'OPTIONAL',
 }
 
+/**
+ * HTTPS policy option for the protocol of the open and click tracking links for your custom redirect domain.
+ */
+export enum HttpsPolicy {
+  /**
+   * Open and Click tracking links will both be wrapped using HTTPS.
+   */
+  REQUIRE = 'REQUIRE',
+
+  /**
+   * Open tracking links will be wrapped using HTTPS.
+   * Click tracking links will be wrapped using the original protocol of the link.
+   */
+  REQUIRE_OPEN_ONLY = 'REQUIRE_OPEN_ONLY',
+
+  /**
+   * Open tracking links will be wrapped using HTTP.
+   * Click tracking links will be wrapped using the original protocol of the link.
+   */
+  OPTIONAL = 'OPTIONAL',
+}
+
 /**
  * Reasons for which recipient email addresses should be automatically added
  * to your account's suppression list
@@ -196,6 +225,9 @@ export class ConfigurationSet extends Resource implements IConfigurationSet {
         throw new ValidationError(`The maximum delivery duration must be less than or equal to 14 hours (50400 seconds), got: ${props.maxDeliveryDuration.toSeconds()} seconds.`, this);
       }
     }
+    if (props.customTrackingHttpsPolicy && !props.customTrackingRedirectDomain) {
+      throw new ValidationError('customTrackingHttpsPolicy can only be set when customTrackingRedirectDomain is also set.', this);
+    }
 
     const configurationSet = new CfnConfigurationSet(this, 'Resource', {
       deliveryOptions: undefinedIfNoKeys({
@@ -215,6 +247,7 @@ export class ConfigurationSet extends Resource implements IConfigurationSet {
       }),
       trackingOptions: undefinedIfNoKeys({
         customRedirectDomain: props.customTrackingRedirectDomain,
+        httpsPolicy: props.customTrackingHttpsPolicy,
       }),
       vdmOptions: undefinedIfNoKeys({
         dashboardOptions: props.vdmOptions?.engagementMetrics !== undefined ? {
diff --git a/packages/aws-cdk-lib/aws-ses/test/configuration-set.test.ts b/packages/aws-cdk-lib/aws-ses/test/configuration-set.test.ts
index 1221fa303b566..9f33d7c7f2f4d 100644
--- a/packages/aws-cdk-lib/aws-ses/test/configuration-set.test.ts
+++ b/packages/aws-cdk-lib/aws-ses/test/configuration-set.test.ts
@@ -1,6 +1,6 @@
 import { Template, Match } from '../../assertions';
 import { Duration, Stack } from '../../core';
-import { ConfigurationSet, ConfigurationSetTlsPolicy, DedicatedIpPool, SuppressionReasons } from '../lib';
+import { ConfigurationSet, ConfigurationSetTlsPolicy, DedicatedIpPool, HttpsPolicy, SuppressionReasons } from '../lib';
 
 let stack: Stack;
 beforeEach(() => {
@@ -43,6 +43,31 @@ test('configuration set with options', () => {
   });
 });
 
+describe('custom tracking domain', () => {
+  test('configuration set with custom tracking domain', () => {
+    new ConfigurationSet(stack, 'ConfigurationSet', {
+      customTrackingRedirectDomain: 'track.cdk.dev',
+      customTrackingHttpsPolicy: HttpsPolicy.REQUIRE,
+    });
+
+    Template.fromStack(stack).hasResourceProperties('AWS::SES::ConfigurationSet', {
+      TrackingOptions: {
+        CustomRedirectDomain: 'track.cdk.dev',
+        HttpsPolicy: 'REQUIRE',
+      },
+    });
+  });
+
+  test.each([undefined, ''])('throw error for specifying custom tracking https policy without custom tracking domain %s', (customTrackingRedirectDomain) => {
+    expect(() => {
+      new ConfigurationSet(stack, 'ConfigurationSet', {
+        customTrackingRedirectDomain,
+        customTrackingHttpsPolicy: HttpsPolicy.REQUIRE,
+      });
+    }).toThrow('customTrackingHttpsPolicy can only be set when customTrackingRedirectDomain is also set.');
+  });
+});
+
 test('configuration set with both engagement metrics and optimized shared delivery enabled', () => {
   new ConfigurationSet(stack, 'ConfigurationSet', {
     vdmOptions: {